VirtualQueryEx


DevX Home    Today's Headlines   Articles Archive   Tip Bank   Forums   

Results 1 to 3 of 3

Thread: VirtualQueryEx

  1. #1
    MacDeath Guest

    VirtualQueryEx


    Hello,

    Can someone explain to me what this does and show me how to use it? This
    would be greatly appreciated.

  2. #2
    Dean Earley Guest

    Re: VirtualQueryEx

    This is taken Directly from MSDN

    ********************************
    VirtualQueryEx
    The VirtualQueryEx function provides information about a range of pages
    within the virtual address space of a specified process.

    DWORD VirtualQueryEx(
    HANDLE hProcess, // handle to process
    LPCVOID lpAddress, // address of region
    PMEMORY_BASIC_INFORMATION lpBuffer,
    // address of information buffer
    DWORD dwLength // size of buffer
    );

    Parameters
    hProcess
    Handle to the process whose memory information is queried. The handle must
    have PROCESS_QUERY_INFORMATION access.
    lpAddress
    Pointer to the base address of the region of pages to be queried. This
    value is rounded down to the next page boundary. To determine the size of a
    page on the host computer, use theGetSystemInfo function.
    lpBuffer
    Pointer to a MEMORY_BASIC_INFORMATION structure in which information about
    the specified page range is returned.
    dwLength
    Specifies the size, in bytes, of the buffer pointed to by the lpBuffer
    parameter.
    Return Values
    The return value is the actual number of bytes returned in the information
    buffer.

    Remarks
    VirtualQueryEx provides information about a region of consecutive pages
    beginning at a specified address that share the following attributes:

    a.. The state of all pages is the same with the MEM_COMMIT, MEM_RESERVE,
    MEM_FREE, MEM_PRIVATE, MEM_MAPPED, or MEM_IMAGE flag.
    b.. If the initial page is not free, all pages in the region are part of
    the same initial allocation of pages reserved by a call to the VirtualAlloc
    function.
    c.. The access of all pages is the same with the PAGE_READONLY,
    PAGE_READWRITE, PAGE_NOACCESS, PAGE_WRITECOPY, PAGE_EXECUTE,
    PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY,
    PAGE_GUARD, or PAGE_NOCACHE flag.
    The VirtualQueryEx function determines the attributes of the first page in
    the region and then scans subsequent pages until it scans the entire range
    of pages, or until it encounters a page with a nonmatching set of
    attributes. The function returns the attributes and the size, in bytes, of
    the region of pages with matching attributes. For example, if there is a 40
    megabyte (MB) region of free memory, and VirtualQueryEx is called on a page
    that is 10 MB into the region, the function will obtain a state of MEM_FREE
    and a size of 30 MB.

    This function is identical to the VirtualQuery function, except that it
    enables access to information about memory in a specified process.

    *****************************************

    MEMORY_BASIC_INFORMATION
    The MEMORY_BASIC_INFORMATION structure contains information about a range of
    pages in the virtual address space of a process. The VirtualQuery and
    VirtualQueryEx functions use this structure.

    typedef struct _MEMORY_BASIC_INFORMATION { // mbi
    PVOID BaseAddress; // base address of region
    PVOID AllocationBase; // allocation base address
    DWORD AllocationProtect; // initial access protection
    DWORD RegionSize; // size, in bytes, of region
    DWORD State; // committed, reserved, free
    DWORD Protect; // current access protection
    DWORD Type; // type of pages
    } MEMORY_BASIC_INFORMATION;
    typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;

    Members
    BaseAddress
    Pointer to the base address of the region of pages.
    AllocationBase
    Pointer to the base address of a range of pages allocated by the
    VirtualAlloc function. The page pointed to by the BaseAddress member is
    contained within this allocation range.
    AllocationProtect
    Specifies the access protection given when the region was initially
    allocated. One of the following flags can be present, along with the
    PAGE_GUARD and PAGE_NOCACHE protection modifier flags: Flag Meaning
    PAGE_READONLY Enables read access to the committed region of pages.
    An attempt to write to the committed region results in an access violation.
    If the system differentiates between read-only access and execute access, an
    attempt to execute code in the committed region results in an access
    violation.
    PAGE_READWRITE Enables both read and write access to the committed
    region of pages.
    PAGE_WRITECOPY Gives copy-on-write access to the committed region of
    pages.
    PAGE_EXECUTE Enables execute access to the committed region of
    pages. An attempt to read or write to the committed region results in an
    access violation.
    PAGE_EXECUTE_READ Enables execute and read access to the committed
    region of pages. An attempt to write to the committed region results in an
    access violation.
    PAGE_EXECUTE_READWRITE Enables execute, read, and write access to
    the committed region of pages.
    PAGE_EXECUTE_WRITECOPY Enables execute, read, and write access to
    the committed region of pages. The pages are shared read-on-write and
    copy-on-write.
    PAGE_GUARD Protects the page with the underlying page protection.
    However, access to the region causes a "guard page entered" condition to be
    raised in the subject process. This flag is a page protection modifier, only
    valid when used with one of the page protections other than PAGE_NOACCESS.
    PAGE_NOACCESS Disables all access to the committed region of pages.
    An attempt to read from, write to, or execute in the committed region
    results in an access violation exception, called a general protection (GP)
    fault.
    PAGE_NOCACHE Allows no caching of the committed regions of pages.
    The hardware attributes for the physical memory should be set to no cache.
    This is not recommended for general usage. It is useful for device drivers;
    for example, mapping a video frame buffer with no caching. This flag is a
    page protection modifier, only valid when used with one of the page
    protections other than PAGE_NOACCESS.


    RegionSize
    Specifies the size, in bytes, of the region beginning at the base address
    in which all pages have identical attributes.
    State
    Specifies the state of the pages in the region. One of the following
    states is indicated: State Meaning
    MEM_COMMIT Indicates committed pages for which physical storage has
    been allocated, either in memory or in the paging file on disk.
    MEM_FREE Indicates free pages not accessible to the calling process
    and available to be allocated. For free pages, the information in the
    AllocationBase, AllocationProtect, Protect, and Type members is undefined.
    MEM_RESERVE Indicates reserved pages where a range of the process's
    virtual address space is reserved without allocating any physical storage.
    For reserved pages, the information in the Protect member is undefined.


    Protect
    Specifies the access protection of the pages in the region. One of the
    flags listed for the AllocationProtect member is specified.
    Type
    Specifies the type of pages in the region. The following types are
    defined: Type Meaning
    MEM_IMAGE Indicates that the memory pages within the region are
    mapped into the view of an image section.
    MEM_MAPPED Indicates that the memory pages within the region are
    mapped into the view of a section.
    MEM_PRIVATE Indicates that the memory pages within the region are
    private (not shared by other processes).


    ************************************
    Hope this helps
    --
    Dean Earley (dean.earley@icode.co.uk)
    Assistant Developer

    iCode Systems
    "MacDeath" <phantom2023@hotmail.com> wrote in message
    news:3a8927a8$1@news.devx.com...
    >
    > Hello,
    >
    > Can someone explain to me what this does and show me how to use it? This
    > would be greatly appreciated.




  3. #3
    Dean Earley Guest

    Re: VirtualQueryEx

    This is taken Directly from MSDN

    ********************************
    VirtualQueryEx
    The VirtualQueryEx function provides information about a range of pages
    within the virtual address space of a specified process.

    DWORD VirtualQueryEx(
    HANDLE hProcess, // handle to process
    LPCVOID lpAddress, // address of region
    PMEMORY_BASIC_INFORMATION lpBuffer,
    // address of information buffer
    DWORD dwLength // size of buffer
    );

    Parameters
    hProcess
    Handle to the process whose memory information is queried. The handle must
    have PROCESS_QUERY_INFORMATION access.
    lpAddress
    Pointer to the base address of the region of pages to be queried. This
    value is rounded down to the next page boundary. To determine the size of a
    page on the host computer, use theGetSystemInfo function.
    lpBuffer
    Pointer to a MEMORY_BASIC_INFORMATION structure in which information about
    the specified page range is returned.
    dwLength
    Specifies the size, in bytes, of the buffer pointed to by the lpBuffer
    parameter.
    Return Values
    The return value is the actual number of bytes returned in the information
    buffer.

    Remarks
    VirtualQueryEx provides information about a region of consecutive pages
    beginning at a specified address that share the following attributes:

    a.. The state of all pages is the same with the MEM_COMMIT, MEM_RESERVE,
    MEM_FREE, MEM_PRIVATE, MEM_MAPPED, or MEM_IMAGE flag.
    b.. If the initial page is not free, all pages in the region are part of
    the same initial allocation of pages reserved by a call to the VirtualAlloc
    function.
    c.. The access of all pages is the same with the PAGE_READONLY,
    PAGE_READWRITE, PAGE_NOACCESS, PAGE_WRITECOPY, PAGE_EXECUTE,
    PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY,
    PAGE_GUARD, or PAGE_NOCACHE flag.
    The VirtualQueryEx function determines the attributes of the first page in
    the region and then scans subsequent pages until it scans the entire range
    of pages, or until it encounters a page with a nonmatching set of
    attributes. The function returns the attributes and the size, in bytes, of
    the region of pages with matching attributes. For example, if there is a 40
    megabyte (MB) region of free memory, and VirtualQueryEx is called on a page
    that is 10 MB into the region, the function will obtain a state of MEM_FREE
    and a size of 30 MB.

    This function is identical to the VirtualQuery function, except that it
    enables access to information about memory in a specified process.

    *****************************************

    MEMORY_BASIC_INFORMATION
    The MEMORY_BASIC_INFORMATION structure contains information about a range of
    pages in the virtual address space of a process. The VirtualQuery and
    VirtualQueryEx functions use this structure.

    typedef struct _MEMORY_BASIC_INFORMATION { // mbi
    PVOID BaseAddress; // base address of region
    PVOID AllocationBase; // allocation base address
    DWORD AllocationProtect; // initial access protection
    DWORD RegionSize; // size, in bytes, of region
    DWORD State; // committed, reserved, free
    DWORD Protect; // current access protection
    DWORD Type; // type of pages
    } MEMORY_BASIC_INFORMATION;
    typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;

    Members
    BaseAddress
    Pointer to the base address of the region of pages.
    AllocationBase
    Pointer to the base address of a range of pages allocated by the
    VirtualAlloc function. The page pointed to by the BaseAddress member is
    contained within this allocation range.
    AllocationProtect
    Specifies the access protection given when the region was initially
    allocated. One of the following flags can be present, along with the
    PAGE_GUARD and PAGE_NOCACHE protection modifier flags: Flag Meaning
    PAGE_READONLY Enables read access to the committed region of pages.
    An attempt to write to the committed region results in an access violation.
    If the system differentiates between read-only access and execute access, an
    attempt to execute code in the committed region results in an access
    violation.
    PAGE_READWRITE Enables both read and write access to the committed
    region of pages.
    PAGE_WRITECOPY Gives copy-on-write access to the committed region of
    pages.
    PAGE_EXECUTE Enables execute access to the committed region of
    pages. An attempt to read or write to the committed region results in an
    access violation.
    PAGE_EXECUTE_READ Enables execute and read access to the committed
    region of pages. An attempt to write to the committed region results in an
    access violation.
    PAGE_EXECUTE_READWRITE Enables execute, read, and write access to
    the committed region of pages.
    PAGE_EXECUTE_WRITECOPY Enables execute, read, and write access to
    the committed region of pages. The pages are shared read-on-write and
    copy-on-write.
    PAGE_GUARD Protects the page with the underlying page protection.
    However, access to the region causes a "guard page entered" condition to be
    raised in the subject process. This flag is a page protection modifier, only
    valid when used with one of the page protections other than PAGE_NOACCESS.
    PAGE_NOACCESS Disables all access to the committed region of pages.
    An attempt to read from, write to, or execute in the committed region
    results in an access violation exception, called a general protection (GP)
    fault.
    PAGE_NOCACHE Allows no caching of the committed regions of pages.
    The hardware attributes for the physical memory should be set to no cache.
    This is not recommended for general usage. It is useful for device drivers;
    for example, mapping a video frame buffer with no caching. This flag is a
    page protection modifier, only valid when used with one of the page
    protections other than PAGE_NOACCESS.


    RegionSize
    Specifies the size, in bytes, of the region beginning at the base address
    in which all pages have identical attributes.
    State
    Specifies the state of the pages in the region. One of the following
    states is indicated: State Meaning
    MEM_COMMIT Indicates committed pages for which physical storage has
    been allocated, either in memory or in the paging file on disk.
    MEM_FREE Indicates free pages not accessible to the calling process
    and available to be allocated. For free pages, the information in the
    AllocationBase, AllocationProtect, Protect, and Type members is undefined.
    MEM_RESERVE Indicates reserved pages where a range of the process's
    virtual address space is reserved without allocating any physical storage.
    For reserved pages, the information in the Protect member is undefined.


    Protect
    Specifies the access protection of the pages in the region. One of the
    flags listed for the AllocationProtect member is specified.
    Type
    Specifies the type of pages in the region. The following types are
    defined: Type Meaning
    MEM_IMAGE Indicates that the memory pages within the region are
    mapped into the view of an image section.
    MEM_MAPPED Indicates that the memory pages within the region are
    mapped into the view of a section.
    MEM_PRIVATE Indicates that the memory pages within the region are
    private (not shared by other processes).


    ************************************
    Hope this helps
    --
    Dean Earley (dean.earley@icode.co.uk)
    Assistant Developer

    iCode Systems
    "MacDeath" <phantom2023@hotmail.com> wrote in message
    news:3a8927a8$1@news.devx.com...
    >
    > Hello,
    >
    > Can someone explain to me what this does and show me how to use it? This
    > would be greatly appreciated.




Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
HTML5 Development Center
 
 
FAQ
Latest Articles
Java
.NET
XML
Database
Enterprise
Questions? Contact us.
C++
Web Development
Wireless
Latest Tips
Open Source


   Development Centers

   -- Android Development Center
   -- Cloud Development Project Center
   -- HTML5 Development Center
   -- Windows Mobile Development Center