Type of memory descriptor, do not modify directly!
typedef struct t_memory { // Memory block descriptor
ulong base; // Base address of memory block
ulong size; // Size of block
ulong type; // Service information, TY_xxx
ulong owner; // Address of owner of the memory
ulong initaccess; // Initial read/write access
ulong access; // Actual status and read/write access
ulong threadid; // Block belongs to this thread or 0
char sect[SHORTLEN]; // Name of module section
char *copy; // Copy used in CPU window or NULL
ulong reserved[8]; // Reserved for plugin compatibility
} t_memory;
Members:
base - base address of memory block in the memory space of debugged process;
size - size of memory block;
type - memory characteristics, combination of bits TY_xxx:
| TY_CODE | Memory block contains image of code section |
| TY_DATA | Contains image of data section |
| TY_IMPDATA | Includes import data |
| TY_EXPDATA | Includes export data |
| TY_RSRC | Contains resources |
| TY_RELOC | Includes relocation data |
| TY_STACK | Contains stack of thread with identifier threadid |
| TY_THREAD | Contains data block of thread with identifier threadid |
| TY_HEADER | Contains COFF header |
| TY_DEFHEAP | Contains default heap |
| TY_HEAP | Contains non-default heap |
| TY_SFX | Contains self-extractor |
| TY_GUARDED | NT only: guarded memory block |
owner - address of memory block that owns this block;
initaccess - type of allowed memory access when block was allocated, one of PAGE_xxx (see description of Windows function VirtualQueryEx for details);
access - actual type of allowed memory access, one of PAGE_xxx
threadid - if memory contains stack of thread data block, identifier of owning thread, otherwise undefined;
sect - name of section (not necessarily null-terinated!) if block is an image of section in executable file, otherwise empty string;
copy - if memory block was backuped in CPU window, pointer to backup copy, or NULL otherwise;
reserved - reserved for future use exclusively by OllyDbg.
See also: Findmemory