Question

I examine address space of process in Windows 7. I use VirtualQueryEx function, and this is some part of my example, where handleOfProcess_ is handle of some process:

MEMORY_BASIC_INFORMATION mbi;
bool ok = (VirtualQueryEx(handleOfProcess_, (LPCVOID)0x00020000, &mbi, sizeof(mbi))== sizeof(mbi));
ok = (VirtualQueryEx(handleOfProcess_, (LPCVOID)0x00021000, &mbi, sizeof(mbi))== sizeof(mbi));

When I do debug, I see, that the AllocationBase of 0x00020000 is 0x00020000, and the Allocationbase of 0x00021000 is 0x00000000, which is the allocationBase of another region.

How can it happen?

Thanks to all.

Était-ce utile?

La solution

From the documentation for MEMORY_BASIC_INFORMATION:

For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top