| DWORD VirtualQueryEx(hProcess, lpAddress, lpBuffer, dwLength) | |||
| HANDLE hProcess; | |||
| LPVOID lpAddress; | |||
| PMEMORY_BASIC_INFORMATION lpBuffer; | |||
| DWORD dwLength; |
Information about a range of pages within the virtual address space of the specified process can be obtained with the VirtualQueryEx function
hProcess
Supplies a handle to the process whose memory is being queried. The handle must have been created with PROCESS_QUERY_INFORMATION access.
lpAddress
The base address of the region of pages to be queried. This value is rounded down to the next host-page-address boundary.
lpBuffer
Points to a buffer that receives a MEMORY_BASIC_INFORMATION structure containing information about the specified page range. The MEMORY_BASIC_INFORMATION structure has the following form:
typedef struct _MEMORY_BASIC_INFORMATION { /* mbi */
PVOID BaseAddress;
PVOID AllocationBase;
DWORD AllocationProtect;
DWORD RegionSize;
DWORD State;
DWORD Protect;
DWORD Type;
} MEMORY_BASIC_INFORMATION;
typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;
dwLength
Specifies the length in bytes of the memory information buffer.
The return value is the actual length of the information stored in the buffer.
This function provides the capability to determine the state, protection, and type of a region of pages within the virtual address space of the specified process. The state of the first page within the region is determined and then subsequent entries in the process address map are scanned from the base address upward until either the entire range of pages has been scanned or until a page with a nonmatching set of attributes is encountered. The region attributes, the length of the region of pages with matching attributes, and an appropriate error value are returned.
VirtualProtectEx, VirtualQuery