static IEnumerable <MemoryInformation> ToEnumerable(MemoryInformation mem_info)
{
List <MemoryInformation> ret = new List <MemoryInformation>();
ret.Add(mem_info);
return(ret.AsReadOnly());
}
internal MappedFile(IEnumerable <MemoryInformation> sections)
{
MemoryInformation first = sections.First();
BaseAddress = first.AllocationBase;
MemoryInformation last = sections.Last();
Size = (last.BaseAddress - BaseAddress) + last.RegionSize;
Sections = sections;
Path = first.MappedImagePath;
IsImage = first.Type == MemoryType.Image;
}
/// <summary>
/// Query all memory information regions in process memory.
/// </summary>
/// <returns>The list of memory regions.</returns>
/// <exception cref="NtException">Thrown on error.</exception>
public static IEnumerable <MemoryInformation> QueryMemoryInformation(SafeKernelObjectHandle process)
{
List <MemoryInformation> ret = new List <MemoryInformation>();
try
{
long base_address = 0;
do
{
MemoryInformation mem_info = QueryMemoryInformation(process, base_address);
ret.Add(mem_info);
base_address = mem_info.BaseAddress + mem_info.RegionSize;
}while (base_address < long.MaxValue);
}
catch (NtException)
{
}
return(ret);
}
internal MappedFile(IEnumerable <MemoryInformation> sections, SafeKernelObjectHandle process)
{
MemoryInformation first = sections.First();
BaseAddress = first.AllocationBase;
MemoryInformation last = sections.Last();
Size = (last.BaseAddress - BaseAddress) + last.RegionSize;
Sections = sections;
Path = first.MappedImagePath;
IsImage = first.Type == MemoryType.Image;
if (IsImage)
{
var image_info = NtVirtualMemory.QueryImageInformation(process, BaseAddress, false);
if (image_info.IsSuccess)
{
ImageSigningLevel = image_info.Result.ImageSigningLevel;
}
}
}
internal MappedFile(MemoryInformation mem_info) : this(ToEnumerable(mem_info))
{
}
internal MappedFile(MemoryInformation mem_info, SafeKernelObjectHandle process)
: this(ToEnumerable(mem_info), process)
{
}