Home/ Questions/Q 3982582
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T05:32:41+00:00

I’m identifying parts of process’s virtual memory using VirtualQuery. I identify regions taken by

  • 0

I’m identifying parts of process’s virtual memory using VirtualQuery. I identify regions taken by mapped files (MEM_MAPPED), but how to determine actual files (filenames) of files allocated there? I suppose it has something to do with MapView* family of APIs but cant figure it out exactly…

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It looks like GetMappedFileName() is the function you want.

    DWORD WINAPI GetMappedFileName(
    __in   HANDLE hProcess,
    __in   LPVOID lpv,
    __out  LPTSTR lpFilename,
    __in   DWORD nSize
);

    GetMappedFileName on MSDN

    • 0