还是API内存数据的问题

[z15881328993]

为什么金山游侠能找到游戏数据的地址，0x06BF3B6C是我用金山游侠搜索到的地址，irtualQueryEx(hgame, (LPVOID)Addr, &INFO, sizeof(MEMORY_BASIC_INFORMATION));检查它的时候INFO.State不是MEM_COMMIT
金山搜到的这个地址是个什么地址，怎么换算成相对进程空间的线性地址
我倾家荡产求教

[lingyin55]

友情顶起

[mengde007]

SIZE_T VirtualQueryEx(
HANDLE hProcess,
LPCVOID lpAddress,
PMEMORY_BASIC_INFORMATION lpBuffer,
SIZE_T dwLength
);

其中的参数
typedef struct _MEMORY_BASIC_INFORMATION { PVOID BaseAddress; PVOID AllocationBase; DWORD AllocationProtect; SIZE_T RegionSize; DWORD State; DWORD Protect; DWORD Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
Members
BaseAddress
Pointer to the base address of the region of pages.
AllocationBase
Pointer to the base address of a range of pages allocated by the VirtualAlloc function. The page pointed to by the BaseAddress member is contained within this allocation range.
AllocationProtect
Memory protection when the region was initially allocated. This member can be one of the memory protection options, along with PAGE_GUARD or PAGE_NOCACHE, as needed.
RegionSize
Size of the region beginning at the base address in which all pages have identical attributes, in bytes.
State
State of the pages in the region. This member can be one of the following values.

[mengde007]

主要是lpBuffer参数；它是个输出；根据他的内容得到你想知道的答案；

[jackzhhuang]

INFO.State不是MEM_COMMIT
===============
不是MEM_COMMIT，那是什么？

我想可能是系统在查询虚拟内存的时候会把没有MEM_COMMIT的虚拟内存commit吧

VirtualQuery查询到的是虚拟内存的内容吧。

[z15881328993]

问题是金山找出来的地址我用VirtualQueryEx去检查它就是个未提交的页面，数据被保护了，金山游侠不会给我们展现的是一个假地址吧

[appleshao]

啊没用过VirtualQueryEx这个API,是读还是写的?我就知道那几个一内存英文单词为开头的读写API,那2个不能修改金币?
我等下个红2测试看看