mquire 1.2.7

Memory forensics and analysis tool for querying Linux kernel memory dumps using SQL
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

//
// Copyright (c) 2025-present, Trail of Bits, Inc.
// All rights reserved.
//
// This source code is licensed in accordance with the terms specified in
// the LICENSE file found in the root directory of this source tree.
//

use crate::memory::virtual_address::VirtualAddress;

use std::{ops::Range, path::PathBuf};

/// Represents memory protection flags for a memory mapping.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct MemoryProtection {
    pub read: bool,
    pub write: bool,
    pub execute: bool,
}

impl MemoryProtection {
    /// Creates a new MemoryProtection object
    pub fn new(read: bool, write: bool, execute: bool) -> Self {
        Self {
            read,
            write,
            execute,
        }
    }
}

/// Information about a file backing a memory mapping
#[derive(Debug, Clone)]
pub struct FileBacking {
    /// The file path
    pub path: PathBuf,

    /// File offset in pages (vm_pgoff)
    pub offset: u64,
}

/// A memory mapping entity
#[derive(Debug, Clone)]
pub struct MemoryMapping {
    /// The kernel virtual address of the vm_area_struct
    pub virtual_address: VirtualAddress,

    /// The kernel virtual address of the task_struct
    pub task: VirtualAddress,

    /// The memory region mapped for the process
    pub region: Range<VirtualAddress>,

    /// The memory protection flags (e.g., read, write, execute)
    pub protection: MemoryProtection,

    /// True if this mapping is shared
    pub shared: bool,

    /// File backing information (only present for file-backed mappings)
    pub file_backing: Option<FileBacking>,
}