determining if a regime of virtual memory is readable

0

let's say I want to examine the entire 4GB address space of my win32 user-mode app. since trying to read directly from random places throws an access violation , I was thinking to check first for readability of each page:

char* p = 0x00000000;
while (p < 0xf0000000 ) 
{
    MEMORY_BASIC_INFORMATION mbi;
    VirtualQuery ( p , & mbi , 100) ;
    if (!(  mbi.Protect | PAGE_NOACCESS ) )        
         char tmp = *p;
    p = p + PAGE_SIZE;


}

is there any other way, more efficient to just that?

c
windows
performance
virtual-memory

1 Answer

0

You must check for state == MEM_COMMIT and protection != PAGE_NOACCESS to avoid invalid memory regions. This code will list the beginning and end address of each valid memory region:


HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());

MEMORY_BASIC_INFORMATION mbi;

while (VirtualQuery(addr, &mbi, sizeof(mbi)))
{
    if (mbi.State == MEM_COMMIT && mbi.Protect != PAGE_NOACCESS)
    {
        std::cout << "base : 0x" << std::hex << mbi.BaseAddress << " end : 0x" << std::hex << (uintptr_t)mbi.BaseAddress + mbi.RegionSize << "\n";
    }
    addr += mbi.RegionSize;
}
answered on Stack Overflow Apr 21, 2020 by GuidedHacking

User contributions licensed under CC BY-SA 3.0