1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93
|
#include "stdafx.h"
#include "windows.h"
#include "iostream"
#include "Psapi.h"
#pragma comment(lib,"Psapi.lib")
using namespace std;
int _tmain(int argc, _TCHAR* argv[])
{
cout << "Parcourir la memoire virtuelle" << endl;
cout << "==============================" << endl;
SIZE_T address = 0;
SIZE_T returnVal = -1;
LPCVOID inputAddress = 0;
HANDLE currProcess = GetCurrentProcess();
MEMORY_BASIC_INFORMATION memInfoStruct;
ZeroMemory(&memInfoStruct, sizeof(MEMORY_BASIC_INFORMATION));
// VirtualQueryEx retourne 0 avec une adress du kernel
// commencer la lecture de la memoire
while(returnVal != 0)
{
inputAddress = (LPCVOID)address;
returnVal = VirtualQueryEx(currProcess, inputAddress, &memInfoStruct, sizeof(MEMORY_BASIC_INFORMATION));
cout << address << "\t" << memInfoStruct.RegionSize << "\t";
// State
// MEM_COMMIT - 0x1000
// MEM_FREE - 0x10000
// MEM_RESERVE - 0x2000
if(memInfoStruct.State == 0x1000 )
{
cout << "MEM_COMMIT\t";
}
else if( memInfoStruct.State == 0x10000 )
{
cout << "MEM_FREE\t";
}
else if( memInfoStruct.State == 0x2000 )
{
cout << "MEM_RESERVE\t";
}
// Protect
// PAGE_EXECUTE - 0x10
// PAGE_EXECUTE_READ - 0x20
// PAGE_EXECUTE_READWRITE - 0x40
// PAGE_EXECUTE_WRITECOPY - 0x80
// PAGE_NOACCESS - 0x01
// PAGE_READONLY - 0x02
// PAGE_READWRITE - 0x04
// PAGE_WRITECOPY - 0x08
// PAGE_GUARD - 0x100
// PAGE_NOCACHE - 0x200
// PAGE_WRITECOMBINE - 0x400
cout << memInfoStruct.AllocationProtect << "\t";
cout << memInfoStruct.Protect << "\t";
// TYPE
// MEM_IMAGE - 0x1000000
// MEM_MAPPED - 0x40000
// MEM_PRIVATE - 0x20000
if(memInfoStruct.Type == 0x1000000 )
{
cout << "MEM_IMAGE\t";
_TCHAR szProcessName[MAX_PATH] = _T("<unknown>");
HMODULE modHandle = (HMODULE)memInfoStruct.AllocationBase;
GetModuleBaseName(currProcess, modHandle, szProcessName, sizeof(szProcessName)/sizeof(TCHAR) );
_tprintf( _T("%s"), szProcessName );
}
else if( memInfoStruct.Type == 0x40000 )
{
cout << "MEM_MAPPED\t";
_TCHAR szProcessName[MAX_PATH] = _T("<unknown>");
HMODULE modHandle = (HMODULE)memInfoStruct.AllocationBase;
GetModuleBaseName(currProcess, modHandle, szProcessName, sizeof(szProcessName)/sizeof(TCHAR) );
_tprintf( _T("%s"), szProcessName );
}
else if( memInfoStruct.Type == 0x20000 )
{
cout << "MEM_PRIVATE\t";
}
cout << endl;
address = address + memInfoStruct.RegionSize;
}
char c;
cin>>c;
return 0;
} |
Partager