MCPcopy Create free account
hub / github.com/ELMERIKH/PyinMemoryPE / query_memory

Method query_memory

windows/winobject/process.py:197–216  ·  view source on GitHub ↗

Query the memory informations about page at ``addr`` :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`

(self, addr)

Source from the content-addressed store, hash-verified

195 return self.create_thread(x, parameter)
196
197 def query_memory(self, addr):
198 """Query the memory informations about page at ``addr``
199
200 :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`
201 """
202 if windows.current_process.bitness == 32 and self.bitness == 64:
203 res = MEMORY_BASIC_INFORMATION64()
204 try:
205 v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res)
206 except NtStatusException as e:
207 if e.code & 0xffffffff == 0XC000000D:
208 raise winproxy.WinproxyError("NtQueryVirtualMemory_32_to_64")
209 raise
210 return res
211
212 info_type = {32 : MEMORY_BASIC_INFORMATION32, 64 : MEMORY_BASIC_INFORMATION64}
213 res = info_type[windows.current_process.bitness]()
214 ptr = ctypes.cast(byref(res), POINTER(MEMORY_BASIC_INFORMATION))
215 winproxy.VirtualQueryEx(self.handle, addr, ptr, sizeof(res))
216 return res
217
218 def memory_state(self):
219 """Yield the memory information for the whole address space of the process

Callers 2

memory_stateMethod · 0.95

Calls 1

castMethod · 0.80

Tested by

no test coverage detected