We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
so, this function always not work, struct MEMORY_REGION_INFORMATION invalid (sizeof)
I fixed this structure as
typedef struct _MEMORY_REGION_INFORMATION { PVOID AllocationBase; //Imagebase ULONG AllocationProtect; ULONG RegionType; SIZE_T RegionSize; //Size of image SIZE_T CommitSize; ULONG_PTR PartitionId; // 19H1 ULONG_PTR NodePreference; // 20H1 } MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION;
and function getSizeOfImageProcessNative() worked correct after this changle
SIZE_T ProcessAccessHelp::getSizeOfImageProcessNative( HANDLE processHandle, DWORD_PTR moduleBase ) { MEMORY_REGION_INFORMATION memRegion = {0}; SIZE_T retLen = 0; if (NativeWinApi::NtQueryVirtualMemory(processHandle, (PVOID)moduleBase, MemoryRegionInformation, &memRegion, sizeof(MEMORY_REGION_INFORMATION), &retLen) == STATUS_SUCCESS) { return memRegion.RegionSize; } return 0; }
The text was updated successfully, but these errors were encountered:
No branches or pull requests
so, this function always not work, struct MEMORY_REGION_INFORMATION invalid (sizeof)
I fixed this structure as
and function getSizeOfImageProcessNative() worked correct after this changle
SIZE_T ProcessAccessHelp::getSizeOfImageProcessNative( HANDLE processHandle, DWORD_PTR moduleBase )
{
MEMORY_REGION_INFORMATION memRegion = {0};
SIZE_T retLen = 0;
if (NativeWinApi::NtQueryVirtualMemory(processHandle, (PVOID)moduleBase, MemoryRegionInformation, &memRegion, sizeof(MEMORY_REGION_INFORMATION), &retLen) == STATUS_SUCCESS)
{
return memRegion.RegionSize;
}
return 0;
}
The text was updated successfully, but these errors were encountered: