t_memory

OllyDbg Plugin API

t_memory

Type of memory descriptor, do not modify directly!

typedef struct t_memory { // Memory block descriptor

ulong base; // Base address of memory block

ulong size; // Size of block

ulong type; // Service information, TY_xxx

ulong owner; // Address of owner of the memory

ulong initaccess; // Initial read/write access

ulong access; // Actual status and read/write access

ulong threadid; // Block belongs to this thread or 0

char sect[SHORTLEN]; // Name of module section

char *copy; // Copy used in CPU window or NULL

ulong reserved[8]; // Reserved for plugin compatibility

} t_memory;

Members:

base - base address of memory block in the memory space of debugged process;

size - size of memory block;

type - memory characteristics, combination of bits TY_xxx:

TY_CODE Memory block contains image of code section
TY_DATA Contains image of data section
TY_IMPDATA Includes import data
TY_EXPDATA Includes export data
TY_RSRC Contains resources
TY_RELOC Includes relocation data
TY_STACK Contains stack of thread with identifier threadid
TY_THREAD Contains data block of thread with identifier threadid
TY_HEADER Contains COFF header
TY_DEFHEAP Contains default heap
TY_HEAP Contains non-default heap
TY_SFX Contains self-extractor
TY_GUARDED NT only: guarded memory block

owner - address of memory block that owns this block;

initaccess - type of allowed memory access when block was allocated, one of PAGE_xxx (see description of Windows function VirtualQueryEx for details);

access - actual type of allowed memory access, one of PAGE_xxx

threadid - if memory contains stack of thread data block, identifier of owning thread, otherwise undefined;

sect - name of section (not necessarily null-terinated!) if block is an image of section in executable file, otherwise empty string;

copy - if memory block was backuped in CPU window, pointer to backup copy, or NULL otherwise;

reserved - reserved for future use exclusively by OllyDbg.

See also: Findmemory