Class MemoryInspection

Namespace

CStructSharp.Memory

Assembly

CStructSharp.dll

A decoded value together with the evidence of where it came from: its logical selection and the physical ranges that supplied its bytes.

public sealed record MemoryInspection : IEquatable<MemoryInspection>

Inheritance

object

MemoryInspection

Implements

IEquatable<MemoryInspection>

Inherited Members

object.GetType()

object.Equals(object, object)

object.ReferenceEquals(object, object)

Remarks

An inspector that shows "PID 42 at kernel address 0xffff800000000ffe, from file offsets 0x2ffe and 0x9000" needs three things: the value, the logical location with its type and member metadata, and the backing fragments after every mapping layer has been resolved. One logical field can span several fragments when it crosses a page boundary. A custom source adapter is reported as a terminal coordinate because the library cannot see how it obtains bytes. The result describes one read; it is not a snapshot and does not prevent the source from changing afterwards.

Constructors

MemoryInspection(object?, MemorySelection, IReadOnlyList<MemoryRegion>)

A decoded value together with the evidence of where it came from: its logical selection and the physical ranges that supplied its bytes.

public MemoryInspection(object? Value, MemorySelection Selection, IReadOnlyList<MemoryRegion> BackingRegions)

Parameters

Value object

Decoded value; pointers keep their stored value as StoredPointer.

Selection MemorySelection

Logical region and metadata of the selected field.

BackingRegions IReadOnlyList<MemoryRegion>

Physical ranges in logical order, resolved through every known mapping layer.

Remarks

An inspector that shows "PID 42 at kernel address 0xffff800000000ffe, from file offsets 0x2ffe and 0x9000" needs three things: the value, the logical location with its type and member metadata, and the backing fragments after every mapping layer has been resolved. One logical field can span several fragments when it crosses a page boundary. A custom source adapter is reported as a terminal coordinate because the library cannot see how it obtains bytes. The result describes one read; it is not a snapshot and does not prevent the source from changing afterwards.

Properties

BackingRegions

Physical ranges in logical order, resolved through every known mapping layer.

public IReadOnlyList<MemoryRegion> BackingRegions { get; init; }

Property Value

IReadOnlyList<MemoryRegion>

Selection

Logical region and metadata of the selected field.

public MemorySelection Selection { get; init; }

Property Value

MemorySelection

Value

Decoded value; pointers keep their stored value as StoredPointer.

public object? Value { get; init; }

Property Value

object

Methods

Deconstruct(out object?, out MemorySelection, out IReadOnlyList<MemoryRegion>)

public void Deconstruct(out object? Value, out MemorySelection Selection, out IReadOnlyList<MemoryRegion> BackingRegions)

Parameters

Value object

Selection MemorySelection

BackingRegions IReadOnlyList<MemoryRegion>

Equals(MemoryInspection?)

public bool Equals(MemoryInspection? other)

Parameters

other MemoryInspection

Returns

bool

Equals(object?)

public override bool Equals(object? obj)

Parameters

obj object

Returns

bool

GetHashCode()

public override int GetHashCode()

Returns

int

ToString()

public override string ToString()

Returns

string

Operators

operator ==(MemoryInspection?, MemoryInspection?)

public static bool operator ==(MemoryInspection? left, MemoryInspection? right)

Parameters

left MemoryInspection

right MemoryInspection

Returns

bool

operator !=(MemoryInspection?, MemoryInspection?)

public static bool operator !=(MemoryInspection? left, MemoryInspection? right)

Parameters

left MemoryInspection

right MemoryInspection

Returns

bool