ParseMem parses the in-memory layout of the PE header for the specified process and base address. If change protection parameter is set to true, this method will attempt to change region protection if the region is marked as inaccessible.
(pid uint32, base uintptr, changeProtection bool, opts ...Option)
| 192 | // is set to true, this method will attempt to change region protection |
| 193 | // if the region is marked as inaccessible. |
| 194 | func ParseMem(pid uint32, base uintptr, changeProtection bool, opts ...Option) (*PE, error) { |
| 195 | access := windows.PROCESS_VM_READ | windows.PROCESS_QUERY_INFORMATION |
| 196 | if changeProtection { |
| 197 | access |= windows.PROCESS_VM_OPERATION |
| 198 | } |
| 199 | process, err := windows.OpenProcess(uint32(access), false, pid) |
| 200 | if err != nil { |
| 201 | return nil, err |
| 202 | } |
| 203 | defer windows.Close(process) |
| 204 | area := va.ReadArea(process, base, MaxHeaderSize, MinHeaderSize, changeProtection) |
| 205 | return ParseBytes(area, opts...) |
| 206 | } |
| 207 | |
| 208 | func newParserOpts(opts opts) *peparser.Options { |
| 209 | return &peparser.Options{ |