static IEnumerable <MemoryInformation> ToEnumerable(MemoryInformation mem_info) { List <MemoryInformation> ret = new List <MemoryInformation>(); ret.Add(mem_info); return(ret.AsReadOnly()); }
internal MappedFile(IEnumerable <MemoryInformation> sections) { MemoryInformation first = sections.First(); BaseAddress = first.AllocationBase; MemoryInformation last = sections.Last(); Size = (last.BaseAddress - BaseAddress) + last.RegionSize; Sections = sections; Path = first.MappedImagePath; IsImage = first.Type == MemoryType.Image; }
/// <summary> /// Query all memory information regions in process memory. /// </summary> /// <returns>The list of memory regions.</returns> /// <exception cref="NtException">Thrown on error.</exception> public static IEnumerable <MemoryInformation> QueryMemoryInformation(SafeKernelObjectHandle process) { List <MemoryInformation> ret = new List <MemoryInformation>(); try { long base_address = 0; do { MemoryInformation mem_info = QueryMemoryInformation(process, base_address); ret.Add(mem_info); base_address = mem_info.BaseAddress + mem_info.RegionSize; }while (base_address < long.MaxValue); } catch (NtException) { } return(ret); }
internal MappedFile(IEnumerable <MemoryInformation> sections, SafeKernelObjectHandle process) { MemoryInformation first = sections.First(); BaseAddress = first.AllocationBase; MemoryInformation last = sections.Last(); Size = (last.BaseAddress - BaseAddress) + last.RegionSize; Sections = sections; Path = first.MappedImagePath; IsImage = first.Type == MemoryType.Image; if (IsImage) { var image_info = NtVirtualMemory.QueryImageInformation(process, BaseAddress, false); if (image_info.IsSuccess) { ImageSigningLevel = image_info.Result.ImageSigningLevel; } } }
internal MappedFile(MemoryInformation mem_info) : this(ToEnumerable(mem_info)) { }
internal MappedFile(MemoryInformation mem_info, SafeKernelObjectHandle process) : this(ToEnumerable(mem_info), process) { }