Package winappdbg :: Package win32 :: Module kernel32 :: Class MemoryBasicInformation
[hide private]
[frames] | no frames]

Class MemoryBasicInformation

source code


Memory information object returned by VirtualQueryEx.

Instance Methods [hide private]
 
__init__(self, mbi=None)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
bool
__contains__(self, address)
Test if the given memory address falls within this memory region.
source code
bool
is_free(self)
Returns: True if the memory in this region is free.
source code
bool
is_reserved(self)
Returns: True if the memory in this region is reserved.
source code
bool
is_commited(self)
Returns: True if the memory in this region is commited.
source code
bool
is_image(self)
Returns: True if the memory in this region belongs to an executable image.
source code
bool
is_mapped(self)
Returns: True if the memory in this region belongs to a mapped file.
source code
bool
is_private(self)
Returns: True if the memory in this region is private.
source code
bool
is_guard(self)
Returns: True if all pages in this region are guard pages.
source code
bool
has_content(self)
Returns: True if the memory in this region has any data in it.
source code
bool
is_readable(self)
Returns: True if all pages in this region are readable.
source code
bool
is_writeable(self)
Returns: True if all pages in this region are writeable.
source code
bool
is_copy_on_write(self)
Returns: True if all pages in this region are marked as copy-on-write.
source code
bool
is_executable(self)
Returns: True if all pages in this region are executable.
source code
bool
is_executable_and_writeable(self)
Returns: True if all pages in this region are executable and writeable.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  READABLE = 238
  WRITEABLE = 204
  COPY_ON_WRITE = 136
  EXECUTABLE = 240
  EXECUTABLE_AND_WRITEABLE = 192
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, mbi=None)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
Overrides: object.__init__

__contains__(self, address)
(In operator)

source code 

Test if the given memory address falls within this memory region.

Parameters:
  • address (int) - Memory address to test.
Returns: bool
True if the given memory address falls within this memory region, False otherwise.

is_free(self)

source code 
Returns: bool
True if the memory in this region is free.

is_reserved(self)

source code 
Returns: bool
True if the memory in this region is reserved.

is_commited(self)

source code 
Returns: bool
True if the memory in this region is commited.

is_image(self)

source code 
Returns: bool
True if the memory in this region belongs to an executable image.

is_mapped(self)

source code 
Returns: bool
True if the memory in this region belongs to a mapped file.

is_private(self)

source code 
Returns: bool
True if the memory in this region is private.

is_guard(self)

source code 
Returns: bool
True if all pages in this region are guard pages.

has_content(self)

source code 
Returns: bool
True if the memory in this region has any data in it.

is_readable(self)

source code 
Returns: bool
True if all pages in this region are readable.

is_writeable(self)

source code 
Returns: bool
True if all pages in this region are writeable.

is_copy_on_write(self)

source code 
Returns: bool
True if all pages in this region are marked as copy-on-write. This means the pages are writeable, but changes are not propagated to disk.

Note: Tipically data sections in executable images are marked like this.

is_executable(self)

source code 
Returns: bool
True if all pages in this region are executable.

Note: Executable pages are always readable.

is_executable_and_writeable(self)

source code 
Returns: bool
True if all pages in this region are executable and writeable.

Note: The presence of such pages make memory corruption vulnerabilities much easier to exploit.