I'm using VMMap to view the address space of a process. In the left corner is the address. I attempted to copy the address and read it from the process.
Here's an example:
I attempted to see if I could read this address with a quick bit of code below. The call to VirtualQueryEx
doesn't fail as the response is not 0
. But, my problem is State
returns a value that indicates the address does not exist and Protect
returns PAGE_NOACCESS
.
Code:
int pid = 10964;
DWORD_PTR addr = 0x2C1811E0000;
MEMORY_BASIC_INFORMATION data;
HANDLE pHandler = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
if (pHandler == NULL) {
printf("Could not find process with id: %i", pid);
return -1;
}
int mResult = VirtualQueryEx(pHandler, addr, &data, sizeof(MEMORY_BASIC_INFORMATION));
if (!mResult) {
printf("Could not query virtual memory. Error: %i", GetLastError());
return -1;
}
printf("Base address: %#010x\n", data.BaseAddress);
printf("Address state: %#010x\n", data.State);
printf("Address protection: %#010x\n", data.Protect);
Are the address in VMMap readable or am I doing something wrong?