internal MappedFile(IEnumerable <MemoryInformation> sections, SafeKernelObjectHandle process)
{
MemoryInformation first = sections.First();
BaseAddress = first.AllocationBase;
MemoryInformation last = sections.Last();
Size = (last.BaseAddress - BaseAddress) + last.RegionSize;
Sections = sections;
Path = first.MappedImagePath;
IsImage = first.Type == MemoryType.Image;
if (IsImage)
{
var image_info = NtVirtualMemory.QueryImageInformation(process, BaseAddress, false);
if (image_info.IsSuccess)
{
ImageSigningLevel = image_info.Result.ImageSigningLevel;
}
}
}
/// <summary>
/// Checks if this mapped view represents the same file.
/// </summary>
/// <param name="address">The address to check.</param>
/// <returns>True if the mapped view represents the same file.</returns>
public bool IsSameMapping(long address)
{
return(NtVirtualMemory.AreMappedFilesTheSame(DangerousGetHandle().ToInt64(), address));
}
/// <summary>
/// Checks if this mapped view represents the same file.
/// </summary>
/// <param name="address">The address to check.</param>
/// <param name="throw_on_error">True to throw on error.</param>
/// <returns>True if the mapped view represents the same file.</returns>
public NtResult <bool> IsSameMapping(long address, bool throw_on_error)
{
return(NtVirtualMemory.AreMappedFilesTheSame(DangerousGetHandle().ToInt64(), address, throw_on_error));
}
