Skip to content

memory ¤

Reading, writing, and describing memory.

Classes:

  • Page –

    Represents the address space and page permissions of at least

Functions:

Attributes:

PAGE_SIZE module-attribute ¤

PAGE_SIZE = 4096

PAGE_MASK module-attribute ¤

PAGE_MASK = ~(PAGE_SIZE - 1)

align_down module-attribute ¤

align_down = round_down

align_up module-attribute ¤

align_up = round_up

Page ¤

Page(
    start: int,
    size: int,
    flags: int,
    offset: int,
    arch_ptrsize: int,
    objfile: str = "",
    in_darwin_shared_cache: bool = False,
    protection_key: int | None = None,
    vm_flags: list[str] | None = None,
)

Represents the address space and page permissions of at least one page of memory.

Methods:

Attributes:

R_OK class-attribute instance-attribute ¤

R_OK = R_OK

W_OK class-attribute instance-attribute ¤

W_OK = W_OK

X_OK class-attribute instance-attribute ¤

X_OK = X_OK

vaddr class-attribute instance-attribute ¤

vaddr = start

memsz class-attribute instance-attribute ¤

memsz = size

flags class-attribute instance-attribute ¤

flags = flags

offset class-attribute instance-attribute ¤

offset = offset

objfile class-attribute instance-attribute ¤

objfile = objfile

Possible non-empty values of objfile: - Contains square brackets "[]" if it's not a memory mapped file. Examples: [stack], [vsyscall], [heap], [vdso] - A path to a file, such as /usr/lib/libc.so.6

in_darwin_shared_cache instance-attribute ¤

in_darwin_shared_cache: bool = in_darwin_shared_cache

Whether this mapping is part of the Darwin Shared Cache.

This is an interesting property to know, as these entries may not be useful to us at all times, and having an easy way to filter them out is helpful..

arch_ptrsize instance-attribute ¤

arch_ptrsize = arch_ptrsize

protection_key instance-attribute ¤

protection_key = protection_key

vm_flags instance-attribute ¤

vm_flags = vm_flags

start property ¤

start: int

Mapping start address.

end property ¤

end: int

Address beyond mapping. So the last effective address is self.end-1 It is the same as displayed in /proc//maps

is_stack property ¤

is_stack: bool

is_heap property ¤

is_heap: bool

is_memory_mapped_file property ¤

is_memory_mapped_file: bool

Whether this mapping is backed by a named file on disk.

Returns True when objfile is a real filesystem path (e.g. /usr/lib/libc.so.6). Returns False for kernel-virtual regions whose names are wrapped in square brackets — [stack], [heap], [vdso], [anon_shmem], etc. — because those are not files that can be opened or parsed as ELF objects.

read property ¤

read: bool

write property ¤

write: bool

execute property ¤

execute: bool

ro property ¤

ro: bool

rw property ¤

rw: bool

wx property ¤

wx: bool

rwx property ¤

rwx: bool

is_guard property ¤

is_guard: bool

permstr property ¤

permstr: str

__str__ ¤

__str__() -> str

__repr__ ¤

__repr__() -> str

__contains__ ¤

__contains__(addr: int) -> bool

__eq__ ¤

__eq__(other: object) -> bool

__lt__ ¤

__lt__(other: object) -> bool

__hash__ ¤

__hash__() -> int

round_down ¤

round_down(address: int, align: int) -> int

round_down(address, align) -> int

Round down address to the nearest increment of align.

round_up ¤

round_up(address: int, align: int) -> int

round_up(address, align) -> int

Round up address to the nearest increment of align.

format_address ¤

format_address(
    vaddr: int,
    memsz: int,
    permstr: str,
    offset: int,
    ptrsize: int,
    objfile: str | None = None,
) -> str

Format the given address as a string.

page_align ¤

page_align(address: int) -> int

page_align(address) -> int

Round down address to the nearest page boundary.

page_size_align ¤

page_size_align(address: int) -> int

page_offset ¤

page_offset(address: int) -> int