IDkmMemoryOperation Interface
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Implemented by base debug monitors to provide access to the memory of the target process. This interface is also implemented by higher level components to provide memory caching. Base debug monitors are responsible for performing the memory I/O, maintaining a table of invisible writes, and providing events when the invisible write table is updated (via DkmProcess.OnInstructionPatchInserted/Removed).
Implementations of this interface may restrict when they are called using a filter defined in their component configuration. The following properties may be used: BaseDebugMonitorId, EngineId, TransportKind.
public interface class IDkmMemoryOperationpublic interface class IDkmMemoryOperation__interface IDkmMemoryOperationpublic interface IDkmMemoryOperationtype IDkmMemoryOperation = interfacePublic Interface IDkmMemoryOperationMethods
| InvisibleWriteMemory(DkmProcess, UInt64, Byte[]) |
Write memory to the target process, but hide the write from calls to ReadMemory. This API may be used to patch instructions or data within the target process to implement debugger features. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function raises an E_INVALID_MEMORY_ADDRESS error. |
| ReadMemory(DkmProcess, UInt64, DkmReadMemoryFlags, Byte[]) |
Read the memory of the target process. |
| ReadMemoryString(DkmProcess, UInt64, DkmReadMemoryFlags, UInt16, Int32) |
Reads a null-terminated string from the target process process's memory. This can be used to read an ANSI or Unicode (UTF-8, UTF-16 or UTF-32) strings. |
| WriteMemory(DkmProcess, UInt64, Byte[]) |
Writes memory to the target process. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function raises an E_INVALID_MEMORY_ADDRESS error. |