private static string FormatText(NtHandle ent)
{
string size = String.Empty;
try
{
using (NtSection section = NtSection.DuplicateFrom(ent.ProcessId, new IntPtr(ent.Handle), SectionAccessRights.Query))
{
size = section.Size.ToString();
}
}
catch (NtException)
{
size = "Unknown";
}
StringBuilder builder = new StringBuilder();
NtType section_type = NtType.GetTypeByName("section");
if (section_type.HasReadPermission(ent.GrantedAccess))
{
builder.Append("R");
}
if (section_type.HasWritePermission(ent.GrantedAccess))
{
builder.Append("W");
}
return(String.Format("[{0}/0x{0:X}] {1} Size: {2} Access: {3}", ent.Handle, ent.Name, size, builder.ToString()));
}
public NtMappedSection OpenMappedFile(bool writable)
{
SectionAccessRights accessRights = SectionAccessRights.MapRead;
if (writable)
{
accessRights |= SectionAccessRights.MapWrite;
}
using (NtSection section = NtSection.DuplicateFrom(_ent.ProcessId, new IntPtr(_ent.Handle), accessRights))
{
return(section.Map(writable ? ProtectionType.ReadWrite : ProtectionType.ReadOnly));
}
}