NewRegion creates a new region for the specified process and base address.

NewRegionProber creates a fresh instance of the region prober.

ReadArea reads a full memory area within a given process, starting at the base address and reading up to the buffer size.

Zeroed determines if all bytes in the area are zeroed.

MemImage indicates that the memory pages within the region are mapped into the view of an image section.

MemMapped indicates that the memory pages within the region are mapped into the view of a section.

MemPrivate Indicates that the memory pages within the region are private that is, not shared by other processes.

SectionData indicates a mapped view of a data file.

SectionImage indicates a mapped view of an executable image.

SectionImageNoExecute indicates a mapped view an executable image file that will not be executed.

SectionPagefile indicates a mapped view of pagefile-backed section.

SectionPhysical indicates that the allocation is a view of the \Device\PhysicalMemory section.

Region describes the state of a range of pages in the process virtual address space and offers convenient methods for reading and accessing region memory.

RegionInfo describes the allocated region page properties.

RegionProber examines metadata about the range of pages within the process virtual address space.