#ifndef _NTMMAPI_H
//
// Virtual memory
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Queries information about a region of virtual memory in a process.
*
* @param ProcessHandle A handle to the process whose memory information is to be queried.
* @param BaseAddress A pointer to the base address of the region of pages to be queried.
* @param MemoryInformationClass The type of information to be queried.
* @param MemoryInformation A pointer to a buffer that receives the memory information.
* @param MemoryInformationLength The size of the buffer pointed to by the MemoryInformation parameter.
* @param ReturnLength A pointer to a variable that receives the number of bytes returned in the MemoryInformation buffer.
* @return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryVirtualMemory(
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress,
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
_Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
_In_ SIZE_T MemoryInformationLength,
_Out_opt_ PSIZE_T ReturnLength
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryVirtualMemory(
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress,
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
_Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
_In_ SIZE_T MemoryInformationLength,
_Out_opt_ PSIZE_T ReturnLength
);
View code on GitHub
This function is documented in Windows Driver Kit here and here.
Function NtQueryVirtualMemory
retrieves parameters of queried memory block.
HANDLE
to process containing queried address in process'es address space.
Virtual address to query.
Information class defined in MEMORY_INFORMATION_CLASS
enumeration type. Currently only one class is supported.
As long as only MemoryBasicInformation
is supported, this value points to structure MEMORY_BASIC_INFORMATION
, defined in <WINNT.h> and described in MS SDK.
Length of Buffer
, in bytes.
Optionally pointer to ULONG
value receiving required size of Buffer
, in bytes.
MEMORY_BASIC_INFORMATION
MEMORY_INFORMATION_CLASS
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtLockVirtualMemory
NtProtectVirtualMemory