process_memory_map
==================

Process memory mapped files and pseudo device/regions.

Platform support
----------------
Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. **Running a query against an unsupported platform will result in the following error:** ``no such table: process_memory_map``

- Windows
- Linux
- Mac OSX
- Free BSD

Table schema
------------

===========  =======  ==============================================
Name         Type     Description                                   
===========  =======  ==============================================
pid          INTEGER  Process (or thread) ID                        
start        TEXT     Virtual start address (hex)                   
end          TEXT     Virtual end address (hex)                     
permissions  TEXT     r=read, w=write, x=execute, p=private (cow)   
offset       BIGINT   Offset into mapped path                       
device       TEXT     MA:MI Major/minor device ID                   
inode        INTEGER  Mapped path inode, 0 means uninitialized (BSS)
path         TEXT     Path to mapped file or mapped type            
pseudo       INTEGER  1 If path is a pseudo path, else 0            
===========  =======  ==============================================

Query examples
--------------

.. code-block:: sql

   select * from process_memory_map where pid = 1