为什么总是在MEM_FREE状态 在线等待,立即给分

[jardyson]

通过VirtualQueryEx取得用户区页面,但该区域页面状态有时全部都是释放状态,不解?这样子程序能正常运行吗?而且此时我如何查询内存数据?

[过去的我]

一般不可能全部是free的。。总要泱射点东西

[jardyson]

但我这个就觉得奇怪,我查询过QQ,还有很多进程,直接空着跑出来.以下是我的C#代码
int sLen = VirtualQueryEx(proceID, ref baseAddr, ref mbi, mbiLen);
while (sLen == mbiLen && baseAddr <= maxAddr)
{
switch (mbi.State)
{
case MEM_COMMIT:
OldFlg = mbi.Protect;
if (mbi.Protect == PAGE_NOACCESS || mbi.Protect == PAGE_GUARD)
{
VirtualProtectEx(proceID, ref baseAddr, mbi.RegionSize, PAGE_EXECUTE_READWRITE, ref OldFlg);
}
ReadProcessMemory(proceID, int.Parse(baseAddr.ToString()), lpBuff, 2, lpWritenn);
if (mbi.Protect == PAGE_NOACCESS || mbi.Protect == PAGE_GUARD)
{
VirtualProtectEx(proceID, ref baseAddr, mbi.RegionSize, OldFlg, ref OldFlg);
}
if (this.coniValue.ToString() == lpBuff[0].ToString())
{
clsM.AddC(MEM_COMMIT);
}
break;
case MEM_FREE:
clsM.AddF(MEM_FREE);
break;
case MEM_RESERVE:
OldFlg = mbi.Protect;
if (mbi.Protect == PAGE_NOACCESS || mbi.Protect == PAGE_GUARD)
{
VirtualProtectEx(proceID, ref baseAddr, mbi.RegionSize, PAGE_EXECUTE_READWRITE, ref OldFlg);
}
VirtualAlloc(ref baseAddr, mbi.RegionSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
ReadProcessMemory(proceID, int.Parse(baseAddr.ToString()), lpBuff, 2, lpWritenn);
if (this.coniValue.ToString() == lpBuff[0].ToString())
{
clsM.AddR(MEM_RESERVE);
}
if (mbi.Protect == PAGE_NOACCESS || mbi.Protect == PAGE_GUARD)
{
VirtualProtectEx(proceID, ref baseAddr, mbi.RegionSize, OldFlg, ref OldFlg);
}
break;
case MEM_PRIVATE:
OldFlg = mbi.Protect;
if (mbi.Protect == PAGE_READWRITE)
{
ReadProcessMemory(proceID, int.Parse(baseAddr.ToString()), lpBuff, 2, lpWritenn);
if (this.coniValue.ToString() == lpBuff[0].ToString())
{
clsM.AddR(MEM_RESERVE);
}
}
break;
}

baseAddr = baseAddr + mbi.RegionSize;

sLen = VirtualQueryEx(proceID, ref baseAddr, ref mbi, mbiLen);
}
我用CE查询过微软自带的小游戏,数据可以立马显示出来,但我怎么查都是空,奇怪...

[jardyson]

没人了吗,顶上去

[frank_ll]

看不懂
帮顶

[baihacker]

MEM_FREE
0x10000
Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined.