14th Chapter Explore Virtual memory (2)

14.4 determine the status of an address space

14.4.1 querying the Memory status API

(1) virtualquery (Ex) function

Parameters	Describe
HANDLE hprocess	The handle of another process to query. (Note that this parameter only VirtualQueryEx, VirtualQuery can only check the information of this process)
Lpcvoid pvaddress	Virtual memory addresses that need to be queried
Pmemory_basic_information Pmbi	The returned information is placed in the memory_basic_information structure that the pointer points to.
DWORD dwlength	The size of the structure described above, indicating the number of bytes copied to the above structure when returned.

(2) Memory_basic_information structural body

Field	Describe
BaseAddress	This value is VirtualQuery (Ex) The first parameter is rounded down to the boundary value of the page
Allocationbase	Identifies the base address of the zone that contains the address that the parameter pvaddress points to
Allocationprotect	Identifies the protection properties that are specified for the zone at the beginning of the subscription area
Regionsize	Identifies the size, in bytes, of the area. The starting address for the zone is baseaddress, and all pages in the zone have the same protection properties, status, and type
State	Identifies the state of a page in an area (Mem_free, Mem_reserve, or Mem_commit) If Mem_free, the allocationbase, allocationprotect, protect, and type members are meaningless. If it is mem_reserve, then the protect member is meaningless.
Protect	Identifies the protection properties (page_*) for all adjacent pages (provided their protection properties, states, and types are the same as the pages that contain the addresses specified in the pvaddress parameter)
Type	Identifies the type of page in the area (Mem_image, mem_mapped, or mem_private)

14.4.2 Custom Vmquery (Ex) function--Get more complete memory information

(1) BOOL vmquery (HANDLE hprocess,lpcvoid pvaddress,pvmquery PVMQ);

(2) Vmquery structural body

Field	Describe	Note
PVOID pvrgnbaseaddress	Represents the starting address for the virtual address space region that contains the address specified by the parameter pvaddress	Area Domain Letter Interest
DWORD dwrgnprotection	Represents the protection attribute specified for the zone when the address space is first Booked (page_*)
size_t rgnsize	Represents the size of the reserved area, in bytes
DWORD Dwrgnstorage	Represents the type of physical memory used for each block in a zone. It can be any of the following values: Mem_free, Mem_image, mem_mapped, or mem_private
DWORD Dwrgnblocks	Represents the number of blocks in a range
DWORD dwrgnguardblks	Represents the number of blocks in a zone that have page_guard protection attribute flags. Typically this value is 0 or 1. If 1, the area is reserved for the thread stack.
BOOL Brgnisastack	Indicates whether the area contains line stacks. This value is obtained by approximate guessing, because there is no way to be absolutely sure whether a zone contains a thread stack
PVOID pvblkbaseaddress	Represents the starting address of the block, which contains the address indicated by the parameter pvaddress	Block Letter Interest
DWORD dwblkprotection	Represents the protection properties of a block
size_t blksize	Represents the size of a block, in bytes
DWORD Dwblkstorage	Represents the memory type of the block. It can be any of the following values: Mem_free, Mem_image, Mem_reserve, mem_mapped, or mem_private

"Vmmap program" shows virtual memory mapping situation

14th Chapter Explore Virtual memory (2)