Package winappdbg :: Package win32 :: Module kernel32 :: Class MemoryBasicInformation

Class MemoryBasicInformation

object --+
         |
        MemoryBasicInformation

Memory information object returned by VirtualQueryEx.

Instance Methods

[hide private]

__init__(self, mbi)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature

source code

bool

__contains__(self, address)
Test if the given memory address falls within this memory region.

source code

bool

is_free(self)
Returns: True if the memory in this region is free. source code

bool

is_reserved(self)
Returns: True if the memory in this region is reserved. source code

bool

is_commited(self)
Returns: True if the memory in this region is commited. source code

bool

is_image(self)
Returns: True if the memory in this region belongs to an executable image. source code

bool

is_mapped(self)
Returns: True if the memory in this region belongs to a mapped file. source code

bool

is_private(self)
Returns: True if the memory in this region is private. source code

bool

is_guard(self)
Returns: True if all pages in this region are guard pages. source code

bool

has_content(self)
Returns: True if the memory in this region has any data in it. source code

bool

is_readable(self)
Returns: True if all pages in this region are readable. source code

bool

is_writeable(self)
Returns: True if all pages in this region are writeable. source code

bool

is_copy_on_write(self)
Returns: True if all pages in this region are marked as copy-on-write. source code

bool

is_executable(self)
Returns: True if all pages in this region are executable. source code

bool

is_executable_and_writeable(self)
Returns: True if all pages in this region are executable and writeable. source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables

[hide private]

READABLE = 238

WRITEABLE = 204

COPY_ON_WRITE = 136

EXECUTABLE = 240

EXECUTABLE_AND_WRITEABLE = 192

Properties

[hide private]

Inherited from object: __class__

Method Details

[hide private]

init(self, mbi)
(Constructor)

source code

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Parameters:

mbi (MEMORY_BASIC_INFORMATION or MemoryBasicInformation) - Either a MEMORY_BASIC_INFORMATION structure or another MemoryBasicInformation instance.

Overrides: object.__init__

contains(self, address)
(In operator)

source code

Test if the given memory address falls within this memory region.

Parameters:

address (int) - Memory address to test.

Returns: bool

True if the given memory address falls within this memory region, False otherwise.

is_free(self)

source code

Returns: bool: True if the memory in this region is free.

is_reserved(self)

source code

Returns: bool: True if the memory in this region is reserved.

is_commited(self)

source code

Returns: bool: True if the memory in this region is commited.

is_image(self)

source code

Returns: bool: True if the memory in this region belongs to an executable image.

is_mapped(self)

source code

Returns: bool: True if the memory in this region belongs to a mapped file.

is_private(self)

source code

Returns: bool: True if the memory in this region is private.

is_guard(self)

source code

Returns: bool: True if all pages in this region are guard pages.

has_content(self)

source code

Returns: bool: True if the memory in this region has any data in it.

is_readable(self)

source code

Returns: bool: True if all pages in this region are readable.

is_writeable(self)

source code

Returns: bool: True if all pages in this region are writeable.

is_copy_on_write(self)

source code

Returns: bool: True if all pages in this region are marked as copy-on-write. This means the pages are writeable, but changes are not propagated to disk.

Note: Tipically data sections in executable images are marked like this.

is_executable(self)

source code

Returns: bool: True if all pages in this region are executable.

Note: Executable pages are always readable.

is_executable_and_writeable(self)

source code

Returns: bool: True if all pages in this region are executable and writeable.

Note: The presence of such pages make memory corruption vulnerabilities much easier to exploit.

Class MemoryBasicInformation

__init__(self, mbi) (Constructor)

__contains__(self, address) (In operator)

is_free(self)

is_reserved(self)

is_commited(self)

is_image(self)

is_mapped(self)

is_private(self)

is_guard(self)

has_content(self)

is_readable(self)

is_writeable(self)

is_copy_on_write(self)

is_executable(self)

is_executable_and_writeable(self)

init(self, mbi)
(Constructor)

contains(self, address)
(In operator)