VirtualQueryEx

[MacDeath]

Hello,

Can someone explain to me what this does and show me how to use it? This
would be greatly appreciated.

[Dean Earley]

This is taken Directly from MSDN

********************************
VirtualQueryEx
The VirtualQueryEx function provides information about a range of pages
within the virtual address space of a specified process.

DWORD VirtualQueryEx(
HANDLE hProcess, // handle to process
LPCVOID lpAddress, // address of region
PMEMORY_BASIC_INFORMATION lpBuffer,
// address of information buffer
DWORD dwLength // size of buffer
);

Parameters
hProcess
Handle to the process whose memory information is queried. The handle must
have PROCESS_QUERY_INFORMATION access.
lpAddress
Pointer to the base address of the region of pages to be queried. This
value is rounded down to the next page boundary. To determine the size of a
page on the host computer, use theGetSystemInfo function.
lpBuffer
Pointer to a MEMORY_BASIC_INFORMATION structure in which information about
the specified page range is returned.
dwLength
Specifies the size, in bytes, of the buffer pointed to by the lpBuffer
parameter.
Return Values
The return value is the actual number of bytes returned in the information
buffer.

Remarks
VirtualQueryEx provides information about a region of consecutive pages
beginning at a specified address that share the following attributes:

a.. The state of all pages is the same with the MEM_COMMIT, MEM_RESERVE,
MEM_FREE, MEM_PRIVATE, MEM_MAPPED, or MEM_IMAGE flag.
b.. If the initial page is not free, all pages in the region are part of
the same initial allocation of pages reserved by a call to the VirtualAlloc
function.
c.. The access of all pages is the same with the PAGE_READONLY,
PAGE_READWRITE, PAGE_NOACCESS, PAGE_WRITECOPY, PAGE_EXECUTE,
PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY,
PAGE_GUARD, or PAGE_NOCACHE flag.
The VirtualQueryEx function determines the attributes of the first page in
the region and then scans subsequent pages until it scans the entire range
of pages, or until it encounters a page with a nonmatching set of
attributes. The function returns the attributes and the size, in bytes, of
the region of pages with matching attributes. For example, if there is a 40
megabyte (MB) region of free memory, and VirtualQueryEx is called on a page
that is 10 MB into the region, the function will obtain a state of MEM_FREE
and a size of 30 MB.

This function is identical to the VirtualQuery function, except that it
enables access to information about memory in a specified process.

*****************************************

MEMORY_BASIC_INFORMATION
The MEMORY_BASIC_INFORMATION structure contains information about a range of
pages in the virtual address space of a process. The VirtualQuery and
VirtualQueryEx functions use this structure.

typedef struct _MEMORY_BASIC_INFORMATION { // mbi
PVOID BaseAddress; // base address of region
PVOID AllocationBase; // allocation base address
DWORD AllocationProtect; // initial access protection
DWORD RegionSize; // size, in bytes, of region
DWORD State; // committed, reserved, free
DWORD Protect; // current access protection
DWORD Type; // type of pages
} MEMORY_BASIC_INFORMATION;
typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;

Members
BaseAddress
Pointer to the base address of the region of pages.
AllocationBase
Pointer to the base address of a range of pages allocated by the
VirtualAlloc function. The page pointed to by the BaseAddress member is
contained within this allocation range.
AllocationProtect
Specifies the access protection given when the region was initially
allocated. One of the following flags can be present, along with the
PAGE_GUARD and PAGE_NOCACHE protection modifier flags: Flag Meaning
PAGE_READONLY Enables read access to the committed region of pages.
An attempt to write to the committed region results in an access violation.
If the system differentiates between read-only access and execute access, an
attempt to execute code in the committed region results in an access
violation.
PAGE_READWRITE Enables both read and write access to the committed
region of pages.
PAGE_WRITECOPY Gives copy-on-write access to the committed region of
pages.
PAGE_EXECUTE Enables execute access to the committed region of
pages. An attempt to read or write to the committed region results in an
access violation.
PAGE_EXECUTE_READ Enables execute and read access to the committed
region of pages. An attempt to write to the committed region results in an
access violation.
PAGE_EXECUTE_READWRITE Enables execute, read, and write access to
the committed region of pages.
PAGE_EXECUTE_WRITECOPY Enables execute, read, and write access to
the committed region of pages. The pages are shared read-on-write and
copy-on-write.
PAGE_GUARD Protects the page with the underlying page protection.
However, access to the region causes a "guard page entered" condition to be
raised in the subject process. This flag is a page protection modifier, only
valid when used with one of the page protections other than PAGE_NOACCESS.
PAGE_NOACCESS Disables all access to the committed region of pages.
An attempt to read from, write to, or execute in the committed region
results in an access violation exception, called a general protection (GP)
fault.
PAGE_NOCACHE Allows no caching of the committed regions of pages.
The hardware attributes for the physical memory should be set to no cache.
This is not recommended for general usage. It is useful for device drivers;
for example, mapping a video frame buffer with no caching. This flag is a
page protection modifier, only valid when used with one of the page
protections other than PAGE_NOACCESS.


RegionSize
Specifies the size, in bytes, of the region beginning at the base address
in which all pages have identical attributes.
State
Specifies the state of the pages in the region. One of the following
states is indicated: State Meaning
MEM_COMMIT Indicates committed pages for which physical storage has
been allocated, either in memory or in the paging file on disk.
MEM_FREE Indicates free pages not accessible to the calling process
and available to be allocated. For free pages, the information in the
AllocationBase, AllocationProtect, Protect, and Type members is undefined.
MEM_RESERVE Indicates reserved pages where a range of the process's
virtual address space is reserved without allocating any physical storage.
For reserved pages, the information in the Protect member is undefined.


Protect
Specifies the access protection of the pages in the region. One of the
flags listed for the AllocationProtect member is specified.
Type
Specifies the type of pages in the region. The following types are
defined: Type Meaning
MEM_IMAGE Indicates that the memory pages within the region are
mapped into the view of an image section.
MEM_MAPPED Indicates that the memory pages within the region are
mapped into the view of a section.
MEM_PRIVATE Indicates that the memory pages within the region are
private (not shared by other processes).


************************************
Hope this helps
--
Dean Earley (dean.earley@icode.co.uk)
Assistant Developer

iCode Systems
"MacDeath" <phantom2023@hotmail.com> wrote in message
news:3a8927a8$1@news.devx.com...
>
> Hello,
>
> Can someone explain to me what this does and show me how to use it? This
> would be greatly appreciated.

[Dean Earley]

This is taken Directly from MSDN

********************************
VirtualQueryEx
The VirtualQueryEx function provides information about a range of pages
within the virtual address space of a specified process.

DWORD VirtualQueryEx(
HANDLE hProcess, // handle to process
LPCVOID lpAddress, // address of region
PMEMORY_BASIC_INFORMATION lpBuffer,
// address of information buffer
DWORD dwLength // size of buffer
);

Parameters
hProcess
Handle to the process whose memory information is queried. The handle must
have PROCESS_QUERY_INFORMATION access.
lpAddress
Pointer to the base address of the region of pages to be queried. This
value is rounded down to the next page boundary. To determine the size of a
page on the host computer, use theGetSystemInfo function.
lpBuffer
Pointer to a MEMORY_BASIC_INFORMATION structure in which information about
the specified page range is returned.
dwLength
Specifies the size, in bytes, of the buffer pointed to by the lpBuffer
parameter.
Return Values
The return value is the actual number of bytes returned in the information
buffer.

Remarks
VirtualQueryEx provides information about a region of consecutive pages
beginning at a specified address that share the following attributes:

a.. The state of all pages is the same with the MEM_COMMIT, MEM_RESERVE,
MEM_FREE, MEM_PRIVATE, MEM_MAPPED, or MEM_IMAGE flag.
b.. If the initial page is not free, all pages in the region are part of
the same initial allocation of pages reserved by a call to the VirtualAlloc
function.
c.. The access of all pages is the same with the PAGE_READONLY,
PAGE_READWRITE, PAGE_NOACCESS, PAGE_WRITECOPY, PAGE_EXECUTE,
PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY,
PAGE_GUARD, or PAGE_NOCACHE flag.
The VirtualQueryEx function determines the attributes of the first page in
the region and then scans subsequent pages until it scans the entire range
of pages, or until it encounters a page with a nonmatching set of
attributes. The function returns the attributes and the size, in bytes, of
the region of pages with matching attributes. For example, if there is a 40
megabyte (MB) region of free memory, and VirtualQueryEx is called on a page
that is 10 MB into the region, the function will obtain a state of MEM_FREE
and a size of 30 MB.

This function is identical to the VirtualQuery function, except that it
enables access to information about memory in a specified process.

*****************************************

MEMORY_BASIC_INFORMATION
The MEMORY_BASIC_INFORMATION structure contains information about a range of
pages in the virtual address space of a process. The VirtualQuery and
VirtualQueryEx functions use this structure.

typedef struct _MEMORY_BASIC_INFORMATION { // mbi
PVOID BaseAddress; // base address of region
PVOID AllocationBase; // allocation base address
DWORD AllocationProtect; // initial access protection
DWORD RegionSize; // size, in bytes, of region
DWORD State; // committed, reserved, free
DWORD Protect; // current access protection
DWORD Type; // type of pages
} MEMORY_BASIC_INFORMATION;
typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;

Members
BaseAddress
Pointer to the base address of the region of pages.
AllocationBase
Pointer to the base address of a range of pages allocated by the
VirtualAlloc function. The page pointed to by the BaseAddress member is
contained within this allocation range.
AllocationProtect
Specifies the access protection given when the region was initially
allocated. One of the following flags can be present, along with the
PAGE_GUARD and PAGE_NOCACHE protection modifier flags: Flag Meaning
PAGE_READONLY Enables read access to the committed region of pages.
An attempt to write to the committed region results in an access violation.
If the system differentiates between read-only access and execute access, an
attempt to execute code in the committed region results in an access
violation.
PAGE_READWRITE Enables both read and write access to the committed
region of pages.
PAGE_WRITECOPY Gives copy-on-write access to the committed region of
pages.
PAGE_EXECUTE Enables execute access to the committed region of
pages. An attempt to read or write to the committed region results in an
access violation.
PAGE_EXECUTE_READ Enables execute and read access to the committed
region of pages. An attempt to write to the committed region results in an
access violation.
PAGE_EXECUTE_READWRITE Enables execute, read, and write access to
the committed region of pages.
PAGE_EXECUTE_WRITECOPY Enables execute, read, and write access to
the committed region of pages. The pages are shared read-on-write and
copy-on-write.
PAGE_GUARD Protects the page with the underlying page protection.
However, access to the region causes a "guard page entered" condition to be
raised in the subject process. This flag is a page protection modifier, only
valid when used with one of the page protections other than PAGE_NOACCESS.
PAGE_NOACCESS Disables all access to the committed region of pages.
An attempt to read from, write to, or execute in the committed region
results in an access violation exception, called a general protection (GP)
fault.
PAGE_NOCACHE Allows no caching of the committed regions of pages.
The hardware attributes for the physical memory should be set to no cache.
This is not recommended for general usage. It is useful for device drivers;
for example, mapping a video frame buffer with no caching. This flag is a
page protection modifier, only valid when used with one of the page
protections other than PAGE_NOACCESS.


RegionSize
Specifies the size, in bytes, of the region beginning at the base address
in which all pages have identical attributes.
State
Specifies the state of the pages in the region. One of the following
states is indicated: State Meaning
MEM_COMMIT Indicates committed pages for which physical storage has
been allocated, either in memory or in the paging file on disk.
MEM_FREE Indicates free pages not accessible to the calling process
and available to be allocated. For free pages, the information in the
AllocationBase, AllocationProtect, Protect, and Type members is undefined.
MEM_RESERVE Indicates reserved pages where a range of the process's
virtual address space is reserved without allocating any physical storage.
For reserved pages, the information in the Protect member is undefined.


Protect
Specifies the access protection of the pages in the region. One of the
flags listed for the AllocationProtect member is specified.
Type
Specifies the type of pages in the region. The following types are
defined: Type Meaning
MEM_IMAGE Indicates that the memory pages within the region are
mapped into the view of an image section.
MEM_MAPPED Indicates that the memory pages within the region are
mapped into the view of a section.
MEM_PRIVATE Indicates that the memory pages within the region are
private (not shared by other processes).


************************************
Hope this helps
--
Dean Earley (dean.earley@icode.co.uk)
Assistant Developer

iCode Systems
"MacDeath" <phantom2023@hotmail.com> wrote in message
news:3a8927a8$1@news.devx.com...
>
> Hello,
>
> Can someone explain to me what this does and show me how to use it? This
> would be greatly appreciated.