Are addresses from VMMap readable?

411 Views Asked by At

I'm using VMMap to view the address space of a process. In the left corner is the address. I attempted to copy the address and read it from the process.

Here's an example:

enter image description here

I attempted to see if I could read this address with a quick bit of code below. The call to VirtualQueryEx doesn't fail as the response is not 0. But, my problem is State returns a value that indicates the address does not exist and Protect returns PAGE_NOACCESS.

enter image description here

Code:

int pid = 10964;
DWORD_PTR addr = 0x2C1811E0000;
MEMORY_BASIC_INFORMATION data;

HANDLE pHandler = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
if (pHandler == NULL) {
    printf("Could not find process with id: %i", pid);
    return -1;
}

int mResult = VirtualQueryEx(pHandler, addr, &data, sizeof(MEMORY_BASIC_INFORMATION));
if (!mResult) {
    printf("Could not query virtual memory. Error: %i", GetLastError());
    return -1;
}

printf("Base address: %#010x\n", data.BaseAddress);
printf("Address state: %#010x\n", data.State);
printf("Address protection: %#010x\n", data.Protect);

Are the address in VMMap readable or am I doing something wrong?

0

There are 0 best solutions below