| 403 | |
| 404 | |
| 405 | ProcessAddrInfoRet ProcessAddrInfo(HANDLE hProcess, PVOID address) { |
| 406 | ProcessAddrInfoRet processAddrInfoRet = {}; // Initialize all fields |
| 407 | |
| 408 | if (!hProcess || hProcess == INVALID_HANDLE_VALUE) { |
| 409 | LOG_A(LOG_ERROR, "ProcessAddrInfo: Invalid process handle"); |
| 410 | return processAddrInfoRet; |
| 411 | } |
| 412 | |
| 413 | MEMORY_BASIC_INFORMATION mbi = {}; |
| 414 | SIZE_T returnLength = 0; |
| 415 | |
| 416 | NTSTATUS status = NtQueryVirtualMemory(hProcess, address, MemoryBasicInformation, &mbi, sizeof(mbi), &returnLength); |
| 417 | if (status != 0) { |
| 418 | LOG_A(LOG_WARNING, "ProcessQuery: Could not query memory address %p in process %p. NTSTATUS: %lx", |
| 419 | address, hProcess, static_cast<unsigned long>(status)); |
| 420 | return processAddrInfoRet; |
| 421 | } |
| 422 | |
| 423 | processAddrInfoRet.name = ""; |
| 424 | processAddrInfoRet.base_addr = mbi.BaseAddress; |
| 425 | processAddrInfoRet.allocation_base = mbi.AllocationBase; |
| 426 | processAddrInfoRet.region_size = mbi.RegionSize; |
| 427 | processAddrInfoRet.allocation_protect = mbi.AllocationProtect; // Missing field |
| 428 | processAddrInfoRet.state = mbi.State; |
| 429 | processAddrInfoRet.protect = mbi.Protect; |
| 430 | processAddrInfoRet.type = mbi.Type; |
| 431 | |
| 432 | processAddrInfoRet.stateStr = getMemoryRegionState(mbi.State); |
| 433 | processAddrInfoRet.protectStr = getMemoryRegionProtect(mbi.Protect); |
| 434 | processAddrInfoRet.typeStr = getMemoryRegionType(mbi.Type); |
| 435 | |
| 436 | return processAddrInfoRet; |
| 437 | } |
| 438 | |
| 439 | |
| 440 | // Unused, produces a lot of data |
no test coverage detected