以下是一个简单的 virtual_query_ex 函数的实现,该函数接受一个进程句柄和一个地址,然后返回该地址所在的虚拟内存区域的信息。

#include <windows.h>

bool virtual_query_ex(HANDLE process_handle, void* address, MEMORY_BASIC_INFORMATION& info)
{
    SIZE_T result = VirtualQueryEx(process_handle, address, &info, sizeof(info));
    return result != 0;
}

我们可以将其用于获取一个进程中指定地址的内存信息。例如:

int main()
{
    HANDLE process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
    if (process_handle == NULL) {
        return 1;
    }

    MEMORY_BASIC_INFORMATION info;
    void* address = (void*)0x01234567;

    if (virtual_query_ex(process_handle, address, info)) {
        printf("Base address: 0x%p\n", info.BaseAddress);
        printf("Allocation base: 0x%p\n", info.AllocationBase);
        printf("Region size: %zu bytes\n", info.RegionSize);
        printf("State: %d\n", info.State);
        printf("Protect: %d\n", info.Protect);
        printf("Type: %d\n", info.Type);
    } else {
        printf("Failed to query memory at address 0x%p\n", address);
    }

    CloseHandle(process_handle);
    return 0;
}
写一个 virtual_query_ex 的C++函数

原文地址: https://www.cveoy.top/t/topic/BDj 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录