feat: resolve file-backed paths for memory regions on Windows and macOS#65
Merged
Conversation
Add GetMappedFileNameW (psapi.dll) on Windows and proc_regionfilename on macOS to populate the MemoryRegion.path field with the backing file path. - win32/functions.py: import psapi, add _get_mapped_filename helper - macos/functions.py: add _get_region_filename helper using proc_regionfilename - macos/libsystem.py: declare proc_regionfilename binding - macos/process.py: pass pid to get_memory_regions - process/region.py: make_region accepts a path kwarg overriding struct lookup - tests/process/test_memory_region.py: integration tests for region enumeration and path resolution
github-actions
Bot
added
win32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Populates
MemoryRegion.pathwith the backing file path on Windows and macOS, matching the existing Linux behavior.Changes
GetMappedFileNameWfrompsapi.dllto get the NT device path (e.g.\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll).proc_regionfilenameto get the mapped file path.make_region: now accepts an optionalpathkeyword argument that overrides the struct-based lookup (used by Win32 and macOS backends).Motivation
Previously only Linux exposed the file-backed path for memory regions (from
/proc/<pid>/maps). Windows and macOS left the field empty. This change brings parity across all three platforms, which is useful for the memory map dialog, module identification, and filtering.