Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

memprocfs

package module

Go to main page

Versions in this module

v0

v0.1.3

May 4, 2026

v0.1.2

Mar 28, 2026

Changes in this version

type Module

+ DebugInfo *ModuleDebugInfo

+ VersionInfo *ModuleVersionInfo

+ type ModuleDebugInfo struct

+ Age uint32

+ Guid [16]byte

+ GuidString string

+ PdbFilename string

+ type ModuleFlag uint32

+ const ModuleFlagDebugInfo

+ const ModuleFlagNone

+ const ModuleFlagVersionInfo

+ type ModuleVersionInfo struct

+ CompanyName string

+ FileDescription string

+ FileVersion string

+ InternalName string

+ LegalCopyright string

+ OriginalFilename string

+ ProductName string

+ ProductVersion string

+ type PfnFlag uint32

v0.1.1

Mar 24, 2026

Changes in this version

+ const MapEATVersion

+ const MapHandleVersion

+ const MapHeapAllocVersion

+ const MapHeapVersion

+ const MapIATVersion

+ const MapKDeviceVersion

+ const MapKDriverVersion

+ const MapKObjectVersion

+ const MapModuleVersion

+ const MapNetVersion

+ const MapPTEVersion

+ const MapPhysMemVersion

+ const MapPoolVersion

+ const MapServiceVersion

+ const MapThreadCallstackVersion

+ const MapThreadVersion

+ const MapUnloadedModuleVersion

+ const MapUserVersion

+ const MapVADExVersion

+ const MapVADVersion

+ const MapVMVersion

+ const PfnFlagExtended

+ const PfnFlagNormal

+ const PidProcessWithKernelMemory

+ var ErrUnsupportedEATVersion = errors.New("unsupported EAT version")

+ var ErrUnsupportedHandleVersion = errors.New("unsupported Handle version")

+ var ErrUnsupportedHeapAllocVersion = errors.New("unsupported HeapAlloc version")

+ var ErrUnsupportedHeapVersion = errors.New("unsupported Heap version")

+ var ErrUnsupportedIATVersion = errors.New("unsupported IAT version")

+ var ErrUnsupportedKDeviceVersion = errors.New("unsupported KDevice version")

+ var ErrUnsupportedKDriverVersion = errors.New("unsupported KDriver version")

+ var ErrUnsupportedKObjectVersion = errors.New("unsupported KObject version")

+ var ErrUnsupportedModuleVersion = errors.New("unsupported Module version")

+ var ErrUnsupportedNetVersion = errors.New("unsupported Net version")

+ var ErrUnsupportedPTEVersion = errors.New("unsupported PTE version")

+ var ErrUnsupportedPhysMemVersion = errors.New("unsupported PhysMem version")

+ var ErrUnsupportedPoolVersion = errors.New("unsupported Pool version")

+ var ErrUnsupportedServiceVersion = errors.New("unsupported Service version")

+ var ErrUnsupportedThreadCallstackVersion = errors.New("unsupported ThreadCallstack version")

+ var ErrUnsupportedThreadVersion = errors.New("unsupported Thread version")

+ var ErrUnsupportedUnloadedModuleVersion = errors.New("unsupported UnloadedModule version")

+ var ErrUnsupportedUserVersion = errors.New("unsupported User version")

+ var ErrUnsupportedVADExVersion = errors.New("unsupported VADEx version")

+ var ErrUnsupportedVADVersion = errors.New("unsupported VAD version")

+ var ErrUnsupportedVMVersion = errors.New("unsupported VM version")

+ func CloseAll()

+ type ConfigOpt uint64

+ const OptConfigDebug

+ const OptConfigIsPagingEnabled

+ const OptConfigIsRefreshEnabled

+ const OptConfigProcCacheTicksPartial

+ const OptConfigProcCacheTicksTotal

+ const OptConfigReadCacheTicks

+ const OptConfigStatisticsFunctionCall

+ const OptConfigTickPeriod

+ const OptConfigTlpCacheTicks

+ const OptConfigVmmVersionMajor

+ const OptConfigVmmVersionMinor

+ const OptConfigVmmVersionRevision

+ const OptConfigYaraRules

+ const OptCoreLeechcoreHandle

+ const OptCoreMaxNativeAddress

+ const OptCoreMemoryModel

+ const OptCorePrintfEnable

+ const OptCoreSystem

+ const OptCoreVerbose

+ const OptCoreVerboseExtra

+ const OptCoreVerboseExtraTlp

+ const OptCoreVmmId

+ const OptForensicMode

+ const OptProcessDtb

+ const OptProcessDtbFastLowIntegrity

+ const OptRefreshAll

+ const OptRefreshFreqFast

+ const OptRefreshFreqMedium

+ const OptRefreshFreqMem

+ const OptRefreshFreqMemPartial

+ const OptRefreshFreqSlow

+ const OptRefreshFreqTlb

+ const OptRefreshFreqTlbPartial

+ const OptWinSystemUniqueId

+ const OptWinVersionBuild

+ const OptWinVersionMajor

+ const OptWinVersionMinor

+ type EatEntry struct

+ ForwardedFunctionName string

+ FunctionAddress uint64

+ FunctionName string

+ OFunctionsArray uint32

+ ONamesArray uint32

+ Ordinal uint32

+ type EatList struct

+ AddressOfFunctions uint64

+ AddressOfNames uint64

+ Count uint32

+ Entries []EatEntry

+ ModuleBaseAddress uint64

+ MultiText string

+ NumberOfForwardedFunctions uint32

+ NumberOfFunctions uint32

+ NumberOfNames uint32

+ OrdinalBase uint32

+ Version uint32

+ type Handle struct

+ GrantedAccess uint32

+ Handle uint32

+ HandleCount uint64

+ Object uint64

+ ObjectCreateInfo uint64

+ PID uint32

+ PointerCount uint64

+ PoolTag uint32

+ SecurityDescriptor uint64

+ Text string

+ Type string

+ TypeIndex uint32

+ type HandleList struct

+ Count uint32

+ Handles []Handle

+ MultiText string

+ Version uint32

+ type HeapAllocEntry struct

+ Address uint64

+ Size uint32

+ Type HeapAllocType

+ type HeapAllocList struct

+ Count uint32

+ Entries []HeapAllocEntry

+ Version uint32

+ type HeapAllocType uint32

+ const HeapAllocTypeNA

+ const HeapAllocTypeNtHeap

+ const HeapAllocTypeNtLarge

+ const HeapAllocTypeNtLfh

+ const HeapAllocTypeNtNa

+ const HeapAllocTypeSegLarge

+ const HeapAllocTypeSegLfh

+ const HeapAllocTypeSegNa

+ const HeapAllocTypeSegVs

+ type HeapEntry struct

+ Address uint64

+ HeapNum uint32

+ IHeap uint32

+ Is32Bit bool

+ Type HeapType

+ type HeapList struct

+ Count uint32

+ Entries []HeapEntry

+ Segments []HeapSegmentEntry

+ Version uint32

+ type HeapSegmentEntry struct

+ Address uint64

+ HeapIndex uint16

+ SegmentType HeapSegmentType

+ Size uint32

+ type HeapSegmentType uint16

+ const HeapSegmentNA

+ const HeapSegmentNtLarge

+ const HeapSegmentNtLfh

+ const HeapSegmentNtNa

+ const HeapSegmentNtSegment

+ const HeapSegmentSegHeap

+ const HeapSegmentSegLarge

+ const HeapSegmentSegNa

+ const HeapSegmentSegSegment

+ type HeapType uint32

+ const HeapTypeNA

+ const HeapTypeNT

+ const HeapTypeSeg

+ type IATThunkInfo struct

+ Is32Bit bool

+ VaFunction uint64

+ VaNameFunc uint64

+ VaNameModule uint64

+ VaThunk uint64

+ type IatEntry struct

+ FunctionAddress uint64

+ FunctionName string

+ ModuleName string

+ Thunk IatThunk

+ type IatList struct

+ Count uint32

+ Entries []IatEntry

+ ModuleBaseAddress uint64

+ MultiText string

+ Version uint32

+ type IatThunk struct

+ Hint uint16

+ Is32Bit bool

+ RvaFirstThunk uint32

+ RvaNameFunction uint32

+ RvaNameModule uint32

+ RvaOriginalFirstThunk uint32

+ type ImageDataDirectory struct

+ Size uint32

+ VirtualAddress uint32

+ type ImageSectionHeader struct

+ Characteristics uint32

+ Name [8]byte

+ NumberOfLinenumbers uint16

+ NumberOfRelocations uint16

+ PointerToLinenumbers uint32

+ PointerToRawData uint32

+ PointerToRelocations uint32

+ SizeOfRawData uint32

+ VirtualAddress uint32

+ VirtualSize uint32

+ type KDeviceEntry struct

+ Depth uint32

+ DeviceType uint32

+ DeviceTypeName string

+ Va uint64

+ VaAttachedDevice uint64

+ VaDriverObject uint64

+ VaFileSystemDevice uint64

+ VolumeInfo string

+ type KDeviceList struct

+ Count uint32

+ Entries []KDeviceEntry

+ Version uint32

+ type KDriverEntry struct

+ CbDriverSize uint64

+ MajorFunction [28]uint64

+ Name string

+ Path string

+ ServiceKeyName string

+ Va uint64

+ VaDeviceObject uint64

+ VaDriverStart uint64

+ type KDriverList struct

+ Count uint32

+ Entries []KDriverEntry

+ Version uint32

+ type KObjectEntry struct

+ Children []uint64

+ Name string

+ Type string

+ Va uint64

+ VaParent uint64

+ type KObjectList struct

+ Count uint32

+ Entries []KObjectEntry

+ Version uint32

+ type MemFlag uint32

+ const MemFlagCacheRecentOnly

+ const MemFlagForceCacheRead

+ const MemFlagForceCacheReadDisable

+ const MemFlagNoCache

+ const MemFlagNoCachePut

+ const MemFlagNoMemCallback

+ const MemFlagNoPaging

+ const MemFlagNoPagingIO

+ const MemFlagNone

+ const MemFlagScatterForcePageRead

+ const MemFlagScatterPrepareExNoMemZero

+ const MemFlagZeroPadOnFail

+ type MemoryModel uint32

+ const MemoryModelARM64

+ const MemoryModelNA

+ const MemoryModelX64

+ const MemoryModelX86

+ const MemoryModelX86PAE

+ type Module struct

+ BaseAddress uint64

+ EntryPoint uint64

+ ExportCount uint32

+ FileSize uint32

+ FullName string

+ ImageSize uint32

+ ImportCount uint32

+ IsWow64 bool

+ Name string

+ SectionCount uint32

+ Type ModuleType

+ type ModuleList struct

+ Count uint32

+ Modules []Module

+ MultiText string

+ Version uint32

+ type ModuleType uint32

+ const ModuleTypeData

+ const ModuleTypeNormal

+ const ModuleTypeUnknown

+ type NetAddr struct

+ Address [16]byte

+ Port uint16

+ Text string

+ Valid bool

+ type NetEntry struct

+ AddressFamily uint16

+ Dst NetAddr

+ Object uint64

+ PID uint32

+ PoolTag uint32

+ Src NetAddr

+ State uint32

+ Text string

+ Timestamp uint64

+ type NetList struct

+ Count uint32

+ Entries []NetEntry

+ MultiText string

+ Version uint32

+ type Option func() []string

+ func WithDevice(device string) Option

+ func WithDeviceFPGA() Option

+ func WithDisableInfoDB() Option

+ func WithDisablePython() Option

+ func WithDisableSymbolServer() Option

+ func WithDisableSymbols() Option

+ func WithForensic(lvl int) Option

+ func WithMemMap(filename string) Option

+ func WithNorefresh() Option

+ func WithPageFile(pageID int, pageFile string) Option

+ func WithPrintf() Option

+ func WithRemote(dsn string) Option

+ func WithVM() Option

+ func WithVMBasic() Option

+ func WithVMNested() Option

+ func WithVerbose() Option

+ func WithWaitInitialize() Option

+ type PfnEntry struct

+ OriginalPte uint64

+ Pfn uint32

+ Pid uint32

+ ReferenceCount uint16

+ Type PfnType

+ TypeExtended PfnTypeExtended

+ Va uint64

+ VaPte uint64

+ type PfnList struct

+ Count uint32

+ Entries []PfnEntry

+ type PfnType uint32

+ const PfnTypeActive

+ const PfnTypeBad

+ const PfnTypeFree

+ const PfnTypeModified

+ const PfnTypeModifiedNoWrite

+ const PfnTypeStandby

+ const PfnTypeTransition

+ const PfnTypeZero

+ type PfnTypeExtended uint32

+ const PfnExtDriverLocked

+ const PfnExtFile

+ const PfnExtLargePage

+ const PfnExtPageTable

+ const PfnExtProcessPrivate

+ const PfnExtShareable

+ const PfnExtUnknown

+ const PfnExtUnused

+ type PhysMemEntry struct

+ BaseAddress uint64

+ Size uint64

+ type PhysMemList struct

+ Count uint32

+ Entries []PhysMemEntry

+ Version uint32

+ type PoolEntry struct

+ Alloc bool

+ Size uint32

+ Tag [4]byte

+ TpPool PoolType

+ TpSS uint8

+ Va uint64

+ type PoolList struct

+ Count uint32

+ Entries []PoolEntry

+ Version uint32

+ type PoolMapFlag uint32

+ const PoolMapFlagAll

+ const PoolMapFlagBig

+ type PoolType uint8

+ const PoolTypeNonPagedPool

+ const PoolTypeNonPagedPoolNx

+ const PoolTypePagedPool

+ const PoolTypeUnknown

+ type ProcessInfo struct

+ DTB uint64

+ IsUserOnly uint32

+ Magic uint64

+ MemoryModel MemoryModel

+ NameLongRaw [64]byte

+ NameRaw [16]byte

+ PID uint32

+ ParentPID uint32

+ Size uint16

+ State uint32

+ SystemType SystemType

+ UserDTB uint64

+ Version uint16

+ Win WinProcessInfo

+ func (pi *ProcessInfo) Name() string

+ func (pi *ProcessInfo) NameLong() string

+ type ProcessInfoStringOptions uint32

+ const ProcessInformationOptStringCmdline

+ const ProcessInformationOptStringPathKernel

+ const ProcessInformationOptStringPathUserImage

+ const ProcessInformationOptStringSID

+ const ProcessInformationOptStringSystemRoot

+ type ProcessIntegrityLevel uint32

+ type PteEntry struct

+ BaseAddress uint64

+ IsWow64 bool

+ Name string

+ PageCount uint64

+ PageFlags uint64

+ SoftwareCount uint32

+ type PteList struct

+ Count uint32

+ Entries []PteEntry

+ MultiText string

+ Version uint32

+ type PteType uint32

+ const PteTypeCompressed

+ const PteTypeDemandZero

+ const PteTypeFile

+ const PteTypeHardware

+ const PteTypeNA

+ const PteTypePageFile

+ const PteTypePrototype

+ const PteTypeTransition

+ type RegistryHive struct

+ BaseAddress uint64

+ Name string

+ Path string

+ ShortName string

+ type RegistryKey struct

+ LastWriteTime uint64

+ Name string

+ type RegistryValue struct

+ Data []byte

+ Name string

+ Type uint32

+ type ScatterHandle struct

+ func (h *ScatterHandle) Clear(pid uint32, flags MemFlag) error

+ func (h *ScatterHandle) Close()

+ func (h *ScatterHandle) Execute() error

+ func (h *ScatterHandle) ExecuteRead() error

+ func (h *ScatterHandle) Prepare(va uint64, cb uint32) error

+ func (h *ScatterHandle) PrepareWrite(va uint64, data []byte) error

+ func (h *ScatterHandle) Read(va uint64, cb uint32) ([]byte, error)

+ type ServiceEntry struct

+ DisplayName string

+ ImagePath string

+ Object uint64

+ Ordinal uint32

+ PID uint32

+ Path string

+ ServiceName string

+ StartType uint32

+ Status ServiceStatus

+ UserAccount string

+ UserType string

+ type ServiceList struct

+ Count uint32

+ Entries []ServiceEntry

+ MultiText string

+ Version uint32

+ type ServiceStatus struct

+ CheckPoint uint32

+ ControlsAccepted uint32

+ CurrentState uint32

+ ServiceSpecificExitCode uint32

+ ServiceType uint32

+ WaitHint uint32

+ Win32ExitCode uint32

+ type SystemType uint32

+ const SystemUnknown32

+ const SystemUnknown64

+ const SystemUnknownPhysical

+ const SystemWindows32

+ const SystemWindows64

+ type Thread struct

+ Affinity uint64

+ BasePriority byte

+ CreateTime uint64

+ ETHREAD uint64

+ ExitStatus uint32

+ ExitTime uint64

+ ImpersonationToken uint64

+ KernelTime uint32

+ PID uint32

+ Priority byte

+ RIP uint64

+ RSP uint64

+ Running byte

+ StackBaseKernel uint64

+ StackBaseUser uint64

+ StackLimitKernel uint64

+ StackLimitUser uint64

+ StartAddress uint64

+ State byte

+ SuspendCount byte

+ TID uint32

+ Teb uint64

+ TrapFrame uint64

+ UserTime uint32

+ WaitReason byte

+ Win32StartAddress uint64

+ type ThreadCallstack struct

+ Count uint32

+ Entries []ThreadCallstackEntry

+ MultiText string

+ PID uint32

+ TID uint32

+ Text string

+ Version uint32

+ type ThreadCallstackEntry struct

+ BaseSP uint64

+ Displacement uint32

+ FunctionName string

+ Index uint32

+ ModuleName string

+ RSP uint64

+ RegPresent bool

+ RetAddr uint64

+ type ThreadList struct

+ Count uint32

+ Threads []Thread

+ Version uint32

+ type UnloadedModule struct

+ BaseAddress uint64

+ Checksum uint32

+ ImageSize uint32

+ IsWow64 bool

+ Name string

+ Timestamp uint32

+ UnloadTime uint64

+ type UnloadedModuleList struct

+ Count uint32

+ Modules []UnloadedModule

+ MultiText string

+ Version uint32

+ type UserEntry struct

+ SID string

+ Text string

+ VaRegHive uint64

+ type UserList struct

+ Count uint32

+ Entries []UserEntry

+ Version uint32

+ type VMList struct

+ Count uint32

+ Entries []VmEntry

+ type Vad struct

+ CommitCharge uint32

+ End uint64

+ FileObject uint64

+ HeapNum uint32

+ IsCommitted bool

+ IsFile bool

+ IsHeap bool

+ IsImage bool

+ IsPageFile bool

+ IsPrivateMemory bool

+ IsStack bool

+ IsTeb bool

+ Protection uint32

+ PrototypePte uint64

+ PrototypePteSize uint32

+ Start uint64

+ Subsection uint64

+ Text string

+ VadAddress uint64

+ VadExPages uint32

+ VadExPagesBase uint32

+ VadType uint32

+ type VadExEntry struct

+ Pa uint64

+ PageMapLevel uint8

+ ProtoPa uint64

+ ProtoPte uint64

+ ProtoType PteType

+ Pte uint64

+ PteFlags uint8

+ Type PteType

+ Va uint64

+ VadBase uint64

+ type VadExList struct

+ Count uint32

+ Entries []VadExEntry

+ type VadList struct

+ Count uint32

+ MultiText string

+ PageCount uint32

+ Vads []Vad

+ Version uint32

+ type VfsEntry struct

+ CreationTime uint64

+ IsDirectory bool

+ LastAccessTime uint64

+ LastWriteTime uint64

+ Name string

+ Size uint64

+ type VmEntry struct

+ GpaMax uint64

+ Handle uintptr

+ IsActive bool

+ IsPhysicalOnly bool

+ IsReadOnly bool

+ Name string

+ ParentVmmMountID uint32

+ PartitionID uint32

+ SystemType SystemType

+ Type VmType

+ VersionBuild uint32

+ VmMemPID uint32

+ type VmType uint32

+ const VmTypeHV

+ const VmTypeHVWHVP

+ const VmTypeUnknown

+ type Vmm struct

+ func NewVmm(libPath string, opts ...Option) (*Vmm, error)

+ func (vmm *Vmm) Close() error

+ func (vmm *Vmm) ConfigGet(option ConfigOpt) (uint64, error)

+ func (vmm *Vmm) ConfigSet(option ConfigOpt, value uint64) error

+ func (vmm *Vmm) GetEatList(pid uint32, moduleName string) (*EatList, error)

+ func (vmm *Vmm) GetHandleList(pid uint32) (*HandleList, error)

+ func (vmm *Vmm) GetHeapAllocList(pid uint32, heapNumOrAddress uint64) (*HeapAllocList, error)

+ func (vmm *Vmm) GetHeapList(pid uint32) (*HeapList, error)

+ func (vmm *Vmm) GetIATThunkInfo(pid uint32, moduleName string, importModuleName string, importFuncName string) (*IATThunkInfo, error)

+ func (vmm *Vmm) GetIatList(pid uint32, moduleName string) (*IatList, error)

+ func (vmm *Vmm) GetKDeviceList() (*KDeviceList, error)

+ func (vmm *Vmm) GetKDriverList() (*KDriverList, error)

+ func (vmm *Vmm) GetKObjectList() (*KObjectList, error)

+ func (vmm *Vmm) GetModuleBase(pid uint32, moduleName string) (uint64, error)

+ func (vmm *Vmm) GetModuleByName(pid uint32, moduleName string) (*Module, error)

+ func (vmm *Vmm) GetModuleList(pid uint32) (*ModuleList, error)

+ func (vmm *Vmm) GetNetList() (*NetList, error)

+ func (vmm *Vmm) GetPfnList(pfns []uint32, flags uint32) (*PfnList, error)

+ func (vmm *Vmm) GetPhysMem() (*PhysMemList, error)

+ func (vmm *Vmm) GetPidByName(processName string) (uint32, error)

+ func (vmm *Vmm) GetPidList() ([]uint32, error)

+ func (vmm *Vmm) GetPoolList(flag PoolMapFlag) (*PoolList, error)

+ func (vmm *Vmm) GetProcAddress(pid uint32, moduleName string, funcName string) (uint64, error)

+ func (vmm *Vmm) GetProcessDirectories(pid uint32, moduleName string) ([16]ImageDataDirectory, error)

+ func (vmm *Vmm) GetProcessInfo(pid uint32) (*ProcessInfo, error)

+ func (vmm *Vmm) GetProcessInfoAll() ([]ProcessInfo, error)

+ func (vmm *Vmm) GetProcessInfoString(pid uint32, opt ProcessInfoStringOptions) (string, error)

+ func (vmm *Vmm) GetProcessSections(pid uint32, moduleName string) ([]ImageSectionHeader, error)

+ func (vmm *Vmm) GetPteList(pid uint32, identifyModules bool) (*PteList, error)

+ func (vmm *Vmm) GetRegistryHives() ([]RegistryHive, error)

+ func (vmm *Vmm) GetRegistrySubKeys(keyPath string) ([]RegistryKey, error)

+ func (vmm *Vmm) GetRegistryValues(keyPath string) ([]RegistryValue, error)

+ func (vmm *Vmm) GetServiceList() (*ServiceList, error)

+ func (vmm *Vmm) GetThreadCallstack(pid, tid uint32) (*ThreadCallstack, error)

+ func (vmm *Vmm) GetThreadList(pid uint32) (*ThreadList, error)

+ func (vmm *Vmm) GetUnloadedModuleList(pid uint32) (*UnloadedModuleList, error)

+ func (vmm *Vmm) GetUserList() (*UserList, error)

+ func (vmm *Vmm) GetVMList() (*VMList, error)

+ func (vmm *Vmm) GetVadExList(pid uint32, oPage uint32, cPage uint32) (*VadExList, error)

+ func (vmm *Vmm) GetVadList(pid uint32, identifyModules bool) (*VadList, error)

+ func (vmm *Vmm) HiveReadEx(vaCMHive uint64, ra uint32, cb uint32, flags MemFlag) ([]byte, uint32, error)

+ func (vmm *Vmm) HiveWrite(vaCMHive uint64, ra uint32, data []byte) error

+ func (vmm *Vmm) InitializePlugins() error

+ func (vmm *Vmm) MemPrefetchPages(pid uint32, addresses []uint64) error

+ func (vmm *Vmm) MemRead(pid uint32, addr uint64, size uint32) ([]byte, error)

+ func (vmm *Vmm) MemReadEx(pid uint32, addr uint64, size uint32, flags MemFlag) ([]byte, uint32, error)

+ func (vmm *Vmm) MemReadPage(pid uint32, addr uint64) ([]byte, error)

+ func (vmm *Vmm) MemVirt2Phys(pid uint32, va uint64) (uint64, error)

+ func (vmm *Vmm) MemWrite(pid uint32, addr uint64, data []byte) error

+ func (vmm *Vmm) PdbLoad(pid uint32, vaModuleBase uint64) (string, error)

+ func (vmm *Vmm) PdbSymbolAddress(module string, symbolName string) (uint64, error)

+ func (vmm *Vmm) PdbSymbolName(module string, addressOrOffset uint64) (string, uint32, error)

+ func (vmm *Vmm) PdbTypeChildOffset(module string, typeName string, childName string) (uint32, error)

+ func (vmm *Vmm) PdbTypeSize(module string, typeName string) (uint32, error)

+ func (vmm *Vmm) RegQueryValueEx(keyValuePath string) (uint32, []byte, error)

+ func (vmm *Vmm) ScatterInitialize(pid uint32, flags MemFlag) (*ScatterHandle, error)

+ func (vmm *Vmm) VfsList(path string) ([]VfsEntry, error)

+ func (vmm *Vmm) VfsRead(path string, cb uint32, offset uint64) ([]byte, error)

+ func (vmm *Vmm) VfsWrite(path string, data []byte, offset uint64) error

+ func (vmm *Vmm) VmGetVmmHandle(vm *VmEntry) (*Vmm, error)

+ func (vmm *Vmm) VmMemRead(vm *VmEntry, qwGPA uint64, cb uint32) ([]byte, error)

+ func (vmm *Vmm) VmMemTranslateGPA(vm *VmEntry, qwGPA uint64) (pa uint64, va uint64, err error)

+ func (vmm *Vmm) VmMemWrite(vm *VmEntry, qwGPA uint64, data []byte) error

+ func (vmm *Vmm) VmScatterInitialize(vm *VmEntry) (*ScatterHandle, error)

+ type WinProcessInfo struct

+ EPROCESS uint64

+ IntegrityLevel ProcessIntegrityLevel

+ IsWow64 uint32

+ LUID uint64

+ PEB uint64

+ PEB32 uint32

+ Reserved1 uint64

+ SIDRaw [260]byte

+ SessionID uint32

v0.1.0

Mar 21, 2026