Skip to main content

detect_memory_dump

Function detect_memory_dump 

Source
pub fn detect_memory_dump<R: Read + Seek>(
    source: &mut R,
) -> Result<Option<MemDumpFormat>>
Expand description

Detect a memory-dump container by its header magic.

Returns Ok(None) for non-dumps — including raw/headerless dumps, which carry no signature and must be selected explicitly (--fs memory). The seek position is reset to 0. Magics mirror memf-format’s plugins (LiME 0x4C694D45, AVML 0x4C4D5641, ELF ET_CORE, crash PAGE + DU64).