ReadProcessMemory fails on some Pages (GetLastError()=299)

前端 未结 2 493
借酒劲吻你
借酒劲吻你 2021-01-06 11:48

I try to read all commited pages of a process (Win7-64). On most pages it works but it fails for a few pages. I cannot explain why. Here is my test programme (compiled x32,

2条回答
  •  爱一瞬间的悲伤
    2021-01-06 12:17

    A little bit of debugging and something interesting is identified: all pages that fail have protection bit PAGE_GUARD set (see MSDN doc). As I interpret the docs, it is by design that you cannot read these pages with ReadProcessMemory.

    if(ReadProcessMemory(hProc, baseOffs,buf,si.dwPageSize,&numByteWritten) == FALSE) {
        assert(mbi.Protect & 0x100);
        OutputDebugString(TEXT("bad\n")); //GetLastError()==ERROR_PARTIALLY_READ; numByteWritten == 0; 
    }
    else {
        assert(!(mbi.Protect & 0x100));
        OutputDebugString(TEXT("good\n")); 
    }
    

提交回复
热议问题