VirtualQueryEx详解

DWORD VirtualQueryEx(
HANDLE hProcess, // 想要查询的地址空间所属的进程的句柄
LPCVOID lpAddress, // 区域地址
PMEMORY_BASIC_INFORMATION lpBuffer, // 结构缓冲区
SIZE_T dwLength // 结构大小
);
返回值:被填充的区域的字节数目
如果返回的字节数目和MEMORY_BASIC_INFORMATION 结构的数目相等则表示执行成功否则为执行失败

typedef struct _MEMORY_BASIC_INFORMATION {
PVOID BaseAddress;
PVOID AllocationBase;
DWORD AllocationProtect;
SIZE_T RegionSize;
DWORD State;
DWORD Protect;
DWORD Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

需要说明的是一个区域中地址中地址空间块的数量也是可以计算的(备忘)
如果几个块AllocationBase相同，但是BaseAddress不同，则表明他们属于同一个块
举个例子
AllocationBase:00030000
AllocationProtect:PAGE_READWRITE
BaseAddress:00030000
Protect:Unknow
RegionSize:fd000
State:MEM_RESERVE
Type:MEM_PRIVATE

AllocationBase:00030000
AllocationProtect:PAGE_READWRITE
BaseAddress:0012D000
Protect:Unknow
RegionSize:1000
State:MEM_COMMIT
Type:MEM_PRIVATE

AllocationBase:00030000
AllocationProtect:PAGE_READWRITE
BaseAddress:0012E000
Protect:PAGE_READWRITE
RegionSize:2000
State:MEM_COMMIT
Type:MEM_PRIVATE
这三个块的AllocationBase都为0x00030000,但是BaseAddress不一样，所以，这三个块同属一个区域