Skip to content

Instantly share code, notes, and snippets.

@malwarezone
Created December 11, 2018 02:52
Show Gist options
  • Save malwarezone/3a01ccc561682c060fea5cc56f5a0a4f to your computer and use it in GitHub Desktop.
Save malwarezone/3a01ccc561682c060fea5cc56f5a0a4f to your computer and use it in GitHub Desktop.
Get limit of the set of pages allocated at the same base
LPVOID get_area_limit(HANDLE processHandle, LPVOID first_addr)
{
MEMORY_BASIC_INFORMATION page_info = { 0 };
//go to the beginning of the area:
SIZE_T out = VirtualQueryEx(processHandle, first_addr, &page_info, sizeof(page_info));
if (GetLastError() == ERROR_INVALID_PARAMETER) {
return nullptr;
}
LPVOID alloc_base = page_info.AllocationBase;
LPVOID next_area = page_info.BaseAddress;
do {
memset(&page_info, 0, sizeof(MEMORY_BASIC_INFORMATION));
SIZE_T out = VirtualQueryEx(processHandle, next_area, &page_info, sizeof(page_info));
if (out != sizeof(page_info)) {
if (GetLastError() == ERROR_INVALID_PARAMETER) {
break;
}
break;
}
if (!alloc_base) { //set first
alloc_base = page_info.AllocationBase;
}
if (page_info.AllocationBase != alloc_base) break; //not the same allocation base
if ((page_info.State & MEM_FREE) || (page_info.State & MEM_COMMIT) == 0) {
break; //not commited
}
next_area = LPVOID((ULONG_PTR)page_info.BaseAddress + page_info.RegionSize);
} while (true);
if (!alloc_base) {
return nullptr; //could not find ANY allocated area at this address
}
if ((ULONG_PTR)next_area < (ULONG_PTR)first_addr) {
return nullptr;
}
return next_area;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment