VirtualQueryEx works, sometimes.

[sheep]

I have a pretty enigmatic problem with VirtualQueryEx. I'm using it to examine the comitted memory of a process. Everything was working great until it suddenly stopped working for no reason whatsoever, without even a change in the code. It would always return 0 with ERROR_NOACCESS on every memory address I tried right after I called it on a process handle that I just opened with full access.

I got it going like this:

Code Select Expand

.code
...
invoke VirtualQueryEx,h,ebx,offset mbi,sizeof MEMORY_BASIC_INFORMATION ; ebx was walking through the pages here on a different process
...
.data
...
mbi MEMORY_BASIC_INFORMATION <0,0,0,0,0,0,0>

Then it got weirder, because I changed the data part to:

Code Select Expand

align 16
mbi MEMORY_BASIC_INFORMATION <0,0,0,0,0,0,0>

and it worked great. I don't know why it works because of that, but the problem is it'll still only work for me when I make that change. It won't work on other machines. Why won't this API work?

[MichaelW]

Perhaps because of this:

Passing a kernel-mode pointer to this function can result in no information being returned, due to security issues. In this case, the return value is zero.

[ToutEnMasm]

hello,
I don't know for what,but if you put your buffer in locals instead of data, you can have the surprise to see it work.                   :green
                        ToutEnMasm

[sheep]

hello,
I don't know for what,but if you put your buffer in locals instead of data, you can have the surprise to see it work.                   :green
                        ToutEnMasm

It does, but I don't get why aligning it makes it work

[sheep]

It does, but I don't get why aligning it makes it work

I got an oppertunity to test it on another machine today and even this isn't working. No matter where I put the MEMORY_BASIC_INFORMATION structure it seems to not give me an error on my machine only.

Anyone else have this experience?

[ToutEnMasm]

Hello,
Win98 react differently than XP.I have made a proc modifying the size of the stack and this one works perfectly in XP but not in win98,If we can have some doc explaining why it works like this , we could made modifies for each system.
                             ToutEnMasm