Home/ Questions/Q 9068195
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T17:08:00+00:00

I know that Windows processes are mapped in ram by loading the PE header

  • 0

I know that Windows processes are mapped in ram by loading the PE header and then the following sections (.text .data etc..) and that I can read them with ReadProcessMemory, but what’s the point of VirtualQueryEx? I think it should read one page at a time (the memory pages used by the paging system) but I don’t see how memory pages are related to the PE sections.. what if I wanted to scan through just the .text sections, should I use VirtualQueryEx too or the pages aren’t related to their contents?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    VirtualQueryEx gets you information about how a page is allocated, what general sort of information it contains, etc. I posted some demo code in a previous answer. This walks through a process and dumps out some information about every block of memory allocated from the OS for a target process.

    ReadProcessMemory will let you read the actual content of a block of memory in a specified process. To use it, you need to specify an address in the target process though — on its own, it has no clue of what’s where in that process.

    If you want to read part of the mapped executable in some process, you’ll typically use VirtualQueryEx to find where in memory the parts you care about have been loaded, then ReadProcessMemory to read the pieces you care about. For example, in another previous answer, I posted some code that searches for a specified pattern in all the pages of a process that are committed and either private or mapped.

    Depending on what you’re looking for (especially if you want to look at things like code in the target process) you might want to use something like the symbol handler API to find the parts you care about though. VirtualQueryEx looks at things with fairly coarse granularity — just for example, it’ll tell you the base address and size of the entire block of memory where an entire executable has been mapped, but doesn’t tell you much about what’s where inside that (often large) block.

    The symbol handler API can tell you (for example) the address of a specific function from that executable (provided that information is available, such as the executable including debugging information, or the function you care about being exported from an exe/dll).

    • 0