private static string FormatText(NtHandle ent) { string size = String.Empty; try { using (NtSection section = NtSection.DuplicateFrom(ent.ProcessId, new IntPtr(ent.Handle), SectionAccessRights.Query)) { size = section.Size.ToString(); } } catch (NtException) { size = "Unknown"; } StringBuilder builder = new StringBuilder(); NtType section_type = NtType.GetTypeByName("section"); if (section_type.HasReadPermission(ent.GrantedAccess)) { builder.Append("R"); } if (section_type.HasWritePermission(ent.GrantedAccess)) { builder.Append("W"); } return(String.Format("[{0}/0x{0:X}] {1} Size: {2} Access: {3}", ent.Handle, ent.Name, size, builder.ToString())); }
public NtMappedSection OpenMappedFile(bool writable) { SectionAccessRights accessRights = SectionAccessRights.MapRead; if (writable) { accessRights |= SectionAccessRights.MapWrite; } using (NtSection section = NtSection.DuplicateFrom(_ent.ProcessId, new IntPtr(_ent.Handle), accessRights)) { return(section.Map(writable ? ProtectionType.ReadWrite : ProtectionType.ReadOnly)); } }