IDA SDK
|
Inspect debugged process memory.
Functions | |
idaman void ida_export | set_dbgmem_source (range_t *(idaapi *dbg_get_memory_config)(int *n), int(idaapi *memory_read)(ea_t ea, void *buffer, int size), int(idaapi *memory_write)(ea_t ea, const void *buffer, int size)) |
Set the memory information source for IDA kernel. More... | |
idaman void ida_export | invalidate_dbgmem_config (void) |
Invalidate the debugged process memory configuration. More... | |
idaman void ida_export | invalidate_dbgmem_contents (ea_t ea, asize_t size) |
Invalidate the debugged process memory contents. More... | |
idaman bool ida_export | is_debugger_on (void) |
Is the debugger currently running? | |
idaman bool ida_export | is_debugger_memory (ea_t ea) |
Is the address mapped to debugger memory? | |
idaman void ida_export set_dbgmem_source | ( | range_t *(idaapi *)(int *n) | dbg_get_memory_config, |
int(idaapi *)(ea_t ea, void *buffer, int size) | memory_read, | ||
int(idaapi *)(ea_t ea, const void *buffer, int size) | memory_write | ||
) |
Set the memory information source for IDA kernel.
This function allows the kernel to use information coming from somewhere other than the database (from the debugger, for example)
dbg_get_memory_config | returns current memory configuration in the dynamic memory allocated by qalloc(). The kernel will qfree() it automatically. If this argument is nullptr, then the debugged process memory is not used.
|
memory_read | read bytes from the debugged process memory |
memory_write | write bytes to the debugged process memory (don't forget to call invalidate_dbgmem_contents() from it) |
idaman void ida_export invalidate_dbgmem_config | ( | void | ) |
Invalidate the debugged process memory configuration.
Call this function if the debugged process might have changed its memory layout (allocated more memory, for example)
idaman void ida_export invalidate_dbgmem_contents | ( | ea_t | ea, |
asize_t | size | ||
) |
Invalidate the debugged process memory contents.
Call this function each time the process has been stopped or the process memory is modified. If ea == BADADDR, then the whole memory contents will be invalidated