Struct MemoryRegion 

pub struct MemoryRegion { /* private fields */ }

A description of a memory region spanning any given address range with information about its start address, its access permissions (i.e. whether it’s readable, writable, and/or executable), and whether or not it’s shared or private.

You can obtain an iterator over all of a processes’ memory regions using the RamInspector::regions method.

Implementations

impl MemoryRegion

pub fn get_contents( &self, inspector: &mut RamInspector, ) -> Result<Vec<u8>, RamInspectError>

Attempts to read the contents of the memory region. This fails if the memory region is not readable, and may spuriously fail if the memory region is shared (in which case you should always handle errors).

pub fn start_addr(&self) -> usize

Gets the start address of the memory region.

pub fn len(&self) -> usize

Gets the length of the memory region.

pub fn end_addr(&self) -> usize

Gets the end address of the memory region. This is equivalent to adding the length to the start address.

pub fn readable(&self) -> bool

Checks if the memory region is readable.

pub fn shared(&self) -> bool

Checks if the memory region is shared.

pub fn writable(&self) -> bool

Checks if the memory region is writable.

Examples found in repository

examples/replacemem.rs (line 52)

    fn inspect_process(pid: i32, search_term: &str, replacement_term: &str) -> Result<(), RamInspectError> {
        unsafe {
            let mut inspector = RamInspector::new(pid)?;
            for (result_addr, memory_region) in inspector.search_for_term(search_term.as_bytes())? {
                if !memory_region.writable() {
                    continue;
                }

                inspector.queue_write(result_addr, replacement_term.as_bytes());
            }
            
            inspector.flush().unwrap();
        }

        Ok(())
    }

examples/firefox_search.rs (line 18)

fn main() {
    use raminspect::RamInspector;
    // Iterate over all running Firefox instances
    for pid in raminspect::find_processes("/usr/lib/firefox/firefox") {
        let mut inspector = match RamInspector::new(pid) {
            Ok(inspector) => inspector,
            Err(_) => continue,
        };
        
        for (proc_addr, memory_region) in inspector.search_for_term(b"Old search text").unwrap() {
            if !memory_region.writable() {
                continue;
            }

            unsafe {
                // This is safe because modifying the text in the Firefox search bar will not crash
                // the browser or negatively impact system stability in any way.

                println!("Writing to process virtual address: 0x{:X}", proc_addr);
                inspector.queue_write(proc_addr, b"New search text");
            }
        }

        unsafe {
            // This is safe since the process is not currently resumed, which would possibly cause a data race.
            inspector.flush().unwrap();
        }
    }
}

pub fn executable(&self) -> bool

Checks if the memory region is executable.

pub fn is_readwrite(&self) -> bool

Checks whether or not the memory region is both readable and writable.

Trait Implementations

impl Clone for MemoryRegion

fn clone(&self) -> MemoryRegion

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MemoryRegion

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.