process_memory_map¶
Process memory mapped files and pseudo device/regions.
Platform support¶
Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: process_memory_map
- Windows
- Linux
- Mac OSX
- Free BSD
Table schema¶
Name | Type | Description |
---|---|---|
pid | INTEGER | Process (or thread) ID |
start | TEXT | Virtual start address (hex) |
end | TEXT | Virtual end address (hex) |
permissions | TEXT | r=read, w=write, x=execute, p=private (cow) |
offset | BIGINT | Offset into mapped path |
device | TEXT | MA:MI Major/minor device ID |
inode | INTEGER | Mapped path inode, 0 means uninitialized (BSS) |
path | TEXT | Path to mapped file or mapped type |
pseudo | INTEGER | 1 If path is a pseudo path, else 0 |
Query examples¶
select * from process_memory_map where pid = 1