diff --git a/docs/api/memory-region.md b/docs/api/memory-region.md index 88857df..b571fae 100644 --- a/docs/api/memory-region.md +++ b/docs/api/memory-region.md @@ -63,8 +63,9 @@ of memory with its address, size, permissions and backing path. :type: str Best-effort path of the file backing the region, or ``""`` when - unknown. Linux exposes this directly from ``/proc//maps``; - Windows and macOS would need extra syscalls and report ``""``. + unknown or anonymous. Linux reads it from ``/proc//maps``; + Windows uses ``GetMappedFileNameW`` (NT device path); macOS uses + ``proc_regionfilename``. ``` ## `MemoryRegionSnapshot` diff --git a/docs/api/utilities.md b/docs/api/utilities.md index c2064a2..13d4591 100644 --- a/docs/api/utilities.md +++ b/docs/api/utilities.md @@ -170,14 +170,18 @@ from PyMemoryEditor.process.region import ( .. py:function:: region_path(struct) - Best-effort path of the file backing the region, or ``""`` when unknown - (Linux only — Windows/macOS would need extra syscalls). + Best-effort path of the file backing the region, or ``""`` when unknown. + Linux reads it from ``/proc//maps``; Windows uses + ``GetMappedFileNameW`` (NT device path); macOS uses + ``proc_regionfilename``. -.. py:function:: make_region(address, size, struct) +.. py:function:: make_region(address, size, struct, *, path="") Build a fully-populated :py:class:`MemoryRegion` from a platform struct. The four boolean fields and ``path`` are computed once via the predicates - above. Backends call this once per region; user code rarely needs it. + above. When *path* is non-empty it overrides the struct-based + ``region_path()`` lookup. Backends call this once per region; user code + rarely needs it. ``` ```{seealso} diff --git a/docs/guide/memory-regions.md b/docs/guide/memory-regions.md index cc782e9..1cebd14 100644 --- a/docs/guide/memory-regions.md +++ b/docs/guide/memory-regions.md @@ -36,7 +36,7 @@ Each region is an instance of `MemoryRegion` — an immutable is_writableboolTrue if the region can be written. is_executableboolTrue if the region contains executable code. is_sharedboolTrue if the region is a shared/file-backed mapping. -pathstrBest-effort path of the file backing the region; populated on Linux (from /proc/<pid>/maps), "" when unknown. +pathstrBest-effort path of the file backing the region. Linux reads it from /proc/<pid>/maps; Windows uses GetMappedFileNameW (NT device path); macOS uses proc_regionfilename. Empty string when unknown or anonymous. structplatform-specificRaw platform descriptor (see below).