for (i=0;i<0x7fffffff;i=i+0x10000)
{
ZwQueryVirtualMemory(hProcess,(PVOID)i,MemorySectionName,out_data,STR_LENGTH,&retLength);
if(!IsBadReadPtr((BYTE*)out_data->SectionFileName.Buffer,1))
if(((BYTE*)out_data->SectionFileName.Buffer)[0]==0x5c)
{
if(wcscmp(wstr, out_data->SectionFileName.Buffer))
{
_wsetlocale(LC_ALL,L"chs");
printf("0x%08x %ws/n",i,out_data->SectionFileName.Buffer);
}
{
ZwQueryVirtualMemory(hProcess,(PVOID)i,MemorySectionName,out_data,STR_LENGTH,&retLength);
if(!IsBadReadPtr((BYTE*)out_data->SectionFileName.Buffer,1))
if(((BYTE*)out_data->SectionFileName.Buffer)[0]==0x5c)
{
if(wcscmp(wstr, out_data->SectionFileName.Buffer))
{
_wsetlocale(LC_ALL,L"chs");
printf("0x%08x %ws/n",i,out_data->SectionFileName.Buffer);
}
wcscpy(wstr, out_data->SectionFileName.Buffer);
}