2

Since I was not clear before I will rewrite my question.

I need to get the absolute base address of a section of memory that was allocated with VirtualAllocEx().

For example, if I allocate 0x20000 bytes and get the address 0x5000000.

I need a method of getting the address 0x5000000 using the value 0x5015000.

VirtualQuery() returns the page address that the value 0x5015000 resides in and not the base address of the allocated section of memory.

So I need a different method to find the base address of any allocated section of memory.

John
  • 5,942
  • 3
  • 42
  • 79
  • Please write complete sentences. – Kerrek SB Jul 21 '15 at 12:57
  • 3
    The rounding is [documented behaviour](https://msdn.microsoft.com/en-us/library/aa908768.aspx) for `VirtualAlloc()`...?!? The function allocates *pages*, of course the address is a page boundary? – DevSolar Jul 21 '15 at 13:00
  • @DevSolar I am aware of page boundaries. Which is why I mentioned them in the first place. – John Jul 21 '15 at 13:18

1 Answers1

3

Disclaimer: no WinAPI experience here whatsoever.

VirtualQuery() returns the page address that the value 0x5015000 resides in and not the base address of the allocated section of memory.

As far as I understood the docs, VirtualQuery() returns a structure containing multiple pieces of information, including...

BaseAddress

A pointer to the base address of the region of pages.

AllocationBase

A pointer to the base address of a range of pages allocated by the VirtualAlloc function. The page pointed to by the BaseAddress member is contained within this allocation range.

Could it be that you checked only BaseAddress and not AllocationBase? Because the latter sounds exactly like what you're looking for...

Community
  • 1
  • 1
DevSolar
  • 67,862
  • 21
  • 134
  • 209
  • @John: LOL... I know those well. Nice to see I have been of help. Sometimes it's beneficial to *not* "know" the function in question and having to look it up. ;-) – DevSolar Jul 21 '15 at 14:37