Created
December 11, 2018 02:52
-
-
Save malwarezone/3a01ccc561682c060fea5cc56f5a0a4f to your computer and use it in GitHub Desktop.
Get limit of the set of pages allocated at the same base
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
LPVOID get_area_limit(HANDLE processHandle, LPVOID first_addr) | |
{ | |
MEMORY_BASIC_INFORMATION page_info = { 0 }; | |
//go to the beginning of the area: | |
SIZE_T out = VirtualQueryEx(processHandle, first_addr, &page_info, sizeof(page_info)); | |
if (GetLastError() == ERROR_INVALID_PARAMETER) { | |
return nullptr; | |
} | |
LPVOID alloc_base = page_info.AllocationBase; | |
LPVOID next_area = page_info.BaseAddress; | |
do { | |
memset(&page_info, 0, sizeof(MEMORY_BASIC_INFORMATION)); | |
SIZE_T out = VirtualQueryEx(processHandle, next_area, &page_info, sizeof(page_info)); | |
if (out != sizeof(page_info)) { | |
if (GetLastError() == ERROR_INVALID_PARAMETER) { | |
break; | |
} | |
break; | |
} | |
if (!alloc_base) { //set first | |
alloc_base = page_info.AllocationBase; | |
} | |
if (page_info.AllocationBase != alloc_base) break; //not the same allocation base | |
if ((page_info.State & MEM_FREE) || (page_info.State & MEM_COMMIT) == 0) { | |
break; //not commited | |
} | |
next_area = LPVOID((ULONG_PTR)page_info.BaseAddress + page_info.RegionSize); | |
} while (true); | |
if (!alloc_base) { | |
return nullptr; //could not find ANY allocated area at this address | |
} | |
if ((ULONG_PTR)next_area < (ULONG_PTR)first_addr) { | |
return nullptr; | |
} | |
return next_area; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment