memaccess

Documentation

Overview

This packages contains an interface for accessing other processes' memory.

Index

• Constants
• func CopyMemory(p process.Process, address uintptr, buffer []byte) (harderror error, softerrors []error)
• func SlidingWalkMemory(p process.Process, startAddress uintptr, bufSize uint, walkFn WalkFunc) (harderror error, softerrors []error)
• func WalkMemory(p process.Process, startAddress uintptr, bufSize uint, walkFn WalkFunc) (harderror error, softerrors []error)
• type Access
  • func (a Access) String() string
• type MemoryRegion
  • func NextMemoryRegion(p process.Process, address uintptr) (region MemoryRegion, harderror error, softerrors []error)
  • func NextMemoryRegionAccess(p process.Process, address uintptr, access Access) (region MemoryRegion, harderror error, softerrors []error)
  • func NextReadableMemoryRegion(p process.Process, address uintptr) (region MemoryRegion, harderror error, softerrors []error)
  • func (mr *MemoryRegion) MarshalJSON() ([]byte, error)
  • func (m MemoryRegion) String() string
• type WalkFunc

Constants

const (
	None       Access = 0
	Readable          = 1
	Writable          = 2
	Executable        = 4
	Free              = 128
)

Functions

func CopyMemory

func CopyMemory(p process.Process, address uintptr, buffer []byte) (harderror error, softerrors []error)

CopyMemory fills the entire buffer with memory from the process starting in address (in the process address space). If there is not enough memory to read it returns a hard error. Note that this is not the only hard error it may return though.

func SlidingWalkMemory

func SlidingWalkMemory(p process.Process, startAddress uintptr, bufSize uint, walkFn WalkFunc) (
	harderror error, softerrors []error)

Thiw function works as WalkMemory, except that it reads overlapped bytes. It first calls walkFn with a full buffer, then advances just half of the buffer size, and calls it again. As with WalkRegion, the buffer can be smaller at the end of a region. NOTE: It doesn't work with odd bufSize.

func WalkMemory

func WalkMemory(p process.Process, startAddress uintptr, bufSize uint, walkFn WalkFunc) (harderror error,
	softerrors []error)

WalkMemory reads all the memory of a process starting at a given address reading upto bufSize bytes into a buffer, and calling walkFn with the buffer and the start address of the memory in the buffer. If walkFn returns false WalkMemory stop reading the memory.

NOTE: It can call to walkFn with a smaller buffer when reading the last part of a memory region.

Types

type Access

type Access uint8

func (Access) String

func (a Access) String() string

type MemoryRegion

type MemoryRegion struct {
	Address uintptr `json:"address"`
	Size    uint    `json:"size"`
	Access  Access  `json:"access"`
	Kind    string  `json:"kind"`
}

MemoryRegion represents a region of readable contiguos memory of a process. No readable memory can be available right next to this region, it's maximal in its upper bound. RES: (This is only true now for NextReadableMemoryRegion)

NOTE: This region is not necessary equivalent to the OS's region, if any.

var NoRegionAvailable MemoryRegion

A sentinel value indicating that there is no more regions available.

func NextMemoryRegion

func NextMemoryRegion(p process.Process, address uintptr) (region MemoryRegion, harderror error, softerrors []error)

NextMemoryRegion returns the next memory region at or after address

If there aren't more regions available the special value NoRegionAvailable is returned.

func NextMemoryRegionAccess

func NextMemoryRegionAccess(p process.Process, address uintptr, access Access) (region MemoryRegion, harderror error, softerrors []error)

NextMemoryRegionAccess returns the next memory region at or after address at least the given access

If there aren't more regions available the special value NoRegionAvailable is returned.

func NextReadableMemoryRegion

func NextReadableMemoryRegion(p process.Process, address uintptr) (region MemoryRegion, harderror error, softerrors []error)

NextReadableMemoryRegion returns a memory region containing address, or the next readable region after address in case addresss is not in a readable region.

If there aren't more regions available the special value NoRegionAvailable is returned.

func (*MemoryRegion) MarshalJSON

func (mr *MemoryRegion) MarshalJSON() ([]byte, error)

func (MemoryRegion) String

func (m MemoryRegion) String() string

type WalkFunc

type WalkFunc func(address uintptr, buf []byte) (keepSearching bool)

This type represents a function used for walking through the memory, see WalkMemory for more details.