/// <summary>
/// Reads the memory from the specified process.
/// </summary>
/// <param name="process">The process.</param>
/// <param name="address">The memory address.</param>
/// <param name="size">The buffer size.</param>
/// <returns>
/// Buffer containing read memory
/// </returns>
public MemoryBuffer ReadMemory(Process process, ulong address, uint size)
{
ElfCoreDump dump = GetDump(process);
return(dump.DumpFileMemoryReader.ReadMemory(address, (int)size));
}
/// <summary>
/// Reads the unicode string.
/// </summary>
/// <param name="process">The process.</param>
/// <param name="address">The address.</param>
/// <param name="length">The length.</param>
public string ReadUnicodeString(Process process, ulong address, int length = -1)
{
ElfCoreDump dump = GetDump(process);
return(dump.DumpFileMemoryReader.ReadWideString(address, length));
}
/// <summary>
/// Gets the process system identifier.
/// </summary>
/// <param name="process">The process.</param>
public uint GetProcessSystemId(Process process)
{
ElfCoreDump dump = GetDump(process);
return(dump.ProcessId);
}
/// <summary>
/// Queries the virtual.
/// </summary>
/// <param name="process">The process.</param>
/// <param name="address">The address.</param>
/// <param name="baseAddress">The base address.</param>
/// <param name="regionSize">Size of the region.</param>
public void QueryVirtual(Process process, ulong address, out ulong baseAddress, out ulong regionSize)
{
ElfCoreDump dump = GetDump(process);
dump.DumpFileMemoryReader.GetMemoryRange(address, out baseAddress, out regionSize);
}
/// <summary>
/// Gets the dump file name of the specified process.
/// </summary>
/// <param name="process">The process.</param>
public string GetProcessDumpFileName(Process process)
{
ElfCoreDump dump = GetDump(process);
return(dump.Path);
}
/// <summary>
/// Gets the architecture type of the specified process.
/// </summary>
/// <param name="process">The process.</param>
public ArchitectureType GetProcessArchitectureType(Process process)
{
ElfCoreDump dump = GetDump(process);
return(dump.GetProcessArchitectureType());
}
/// <summary>
/// Gets the dump file memory reader.
/// </summary>
/// <param name="process">The process.</param>
public DumpFileMemoryReader GetDumpFileMemoryReader(Process process)
{
ElfCoreDump dump = GetDump(process);
return(dump.DumpFileMemoryReader);
}
/// <summary>
/// Gets the name of the loaded image. Unless Microsoft CodeView symbols are present, this is the same as the image name.
/// </summary>
/// <param name="module">The module.</param>
public string GetModuleLoadedImage(Module module)
{
ElfCoreDump dump = GetDump(module.Process);
return(dump.GetModuleOriginalPath(module.Address));
}
/// <summary>
/// Gets the memory regions.
/// </summary>
/// <param name="process">The process.</param>
public MemoryRegion[] GetMemoryRegions(Process process)
{
ElfCoreDump dump = GetDump(process);
return(dump.DumpFileMemoryReader.GetMemoryRanges());
}
