/// <summary> /// Reads the memory from the specified process. /// </summary> /// <param name="process">The process.</param> /// <param name="address">The memory address.</param> /// <param name="size">The buffer size.</param> /// <returns> /// Buffer containing read memory /// </returns> public MemoryBuffer ReadMemory(Process process, ulong address, uint size) { ElfCoreDump dump = GetDump(process); return(dump.DumpFileMemoryReader.ReadMemory(address, (int)size)); }
/// <summary> /// Reads the unicode string. /// </summary> /// <param name="process">The process.</param> /// <param name="address">The address.</param> /// <param name="length">The length.</param> public string ReadUnicodeString(Process process, ulong address, int length = -1) { ElfCoreDump dump = GetDump(process); return(dump.DumpFileMemoryReader.ReadWideString(address, length)); }
/// <summary> /// Gets the process system identifier. /// </summary> /// <param name="process">The process.</param> public uint GetProcessSystemId(Process process) { ElfCoreDump dump = GetDump(process); return(dump.ProcessId); }
/// <summary> /// Queries the virtual. /// </summary> /// <param name="process">The process.</param> /// <param name="address">The address.</param> /// <param name="baseAddress">The base address.</param> /// <param name="regionSize">Size of the region.</param> public void QueryVirtual(Process process, ulong address, out ulong baseAddress, out ulong regionSize) { ElfCoreDump dump = GetDump(process); dump.DumpFileMemoryReader.GetMemoryRange(address, out baseAddress, out regionSize); }
/// <summary> /// Gets the dump file name of the specified process. /// </summary> /// <param name="process">The process.</param> public string GetProcessDumpFileName(Process process) { ElfCoreDump dump = GetDump(process); return(dump.Path); }
/// <summary> /// Gets the architecture type of the specified process. /// </summary> /// <param name="process">The process.</param> public ArchitectureType GetProcessArchitectureType(Process process) { ElfCoreDump dump = GetDump(process); return(dump.GetProcessArchitectureType()); }
/// <summary> /// Gets the dump file memory reader. /// </summary> /// <param name="process">The process.</param> public DumpFileMemoryReader GetDumpFileMemoryReader(Process process) { ElfCoreDump dump = GetDump(process); return(dump.DumpFileMemoryReader); }
/// <summary> /// Gets the name of the loaded image. Unless Microsoft CodeView symbols are present, this is the same as the image name. /// </summary> /// <param name="module">The module.</param> public string GetModuleLoadedImage(Module module) { ElfCoreDump dump = GetDump(module.Process); return(dump.GetModuleOriginalPath(module.Address)); }
/// <summary> /// Gets the memory regions. /// </summary> /// <param name="process">The process.</param> public MemoryRegion[] GetMemoryRegions(Process process) { ElfCoreDump dump = GetDump(process); return(dump.DumpFileMemoryReader.GetMemoryRanges()); }