Class
GumMemoryAccessMonitor
Description [src]
final class Gum.MemoryAccessMonitor : GObject.Object
{
/* No available fields */
}Monitors a set of memory ranges and reports accesses to them.
The monitor strips the watched permissions from the pages backing each range
and uses a GumExceptor to catch the resulting access violations, so
it needs no debugger. Whenever monitored memory is touched in a way that
matches the access mask, a GumMemoryAccessNotify fires with the
details of the access.
A common use is coverage-style tracking: with auto-reset enabled each page is
reported the first time it is touched and then runs unhindered, while the
pages_completed / pages_total fields of GumMemoryAccessDetails
reveal how much of the watched memory has been reached.
static void on_access (GumMemoryAccessMonitor * monitor,
const GumMemoryAccessDetails * details, gpointer user_data);
void
watch (gpointer base, gsize size)
{
GumMemoryRange range = { GUM_ADDRESS (base), size };
g_autoptr(GError) error = NULL;
GumMemoryAccessMonitor * monitor = gum_memory_access_monitor_new (
&range, 1, GUM_PAGE_WRITE, TRUE, on_access, NULL, NULL);
if (!gum_memory_access_monitor_enable (monitor, &error))
g_printerr ("Failed to enable: %s\n", error->message);
}
Constructors
gum_memory_access_monitor_new
Creates a monitor for the given ranges, each rounded out to page granularity. Call gum_memory_access_monitor_enable() to start watching.
Instance methods
gum_memory_access_monitor_disable
Stops watching, restoring the original page permissions and removing the exception handler. Safe to call when not enabled.
gum_memory_access_monitor_enable
Starts watching the configured ranges, stripping the masked permissions from their pages and installing the exception handler. Fails if a monitored page is unallocated or already fully inaccessible.
Signals
Signals inherited from GObject (1)
GObject::notify
The notify signal is emitted on an object when one of its properties has its value set through g_object_set_property(), g_object_set(), et al.