MEMORY_BASIC_INFORMATION 和 VirtualQueryEx 在不同架构上 [英] MEMORY_BASIC_INFORMATION and VirtualQueryEx on different architectures

问题描述

MEMORY_BASIC_INFORMATION 的 MSDN 页面 在备注部分指出 MEMORY_BASIC_INFORMATION32 和 MEMORY_BASIC_INFORMATION64 应该在目标进程在与查询程序不同的体系结构上运行的情况下指定(当使用 VirtualQueryEx).我还发现了一些 SO 帖子，这些帖子在他们对相关问题的回答中指出了这一点.尽管我发现 VirtualQUEryEx 传递给我的 MEMORY_BASIC_INFORMATION 版本与我的程序的体系结构相同，尽管目标不同.我想确保我正确解析了来自 VirtualQueryEx 的信息.我真的需要指定我用来匹配目标架构的 MEMORY_BASIC_INFORMATION 的版本吗?如果是这样，为什么 VirtualQueryEx 只返回我程序架构的版本，我该如何解决?

The MSDN page for MEMORY_BASIC_INFORMATION points out in the remarks section that MEMORY_BASIC_INFORMATION32 and MEMORY_BASIC_INFORMATION64 should be specified in situations where the target process is running on a different architecture than the querying program (when using VirtualQueryEx). I also found some SO posts which pointed this out in their answers to related questions. I discovered though that the version of MEMORY_BASIC_INFORMATION I was being passed by VirtualQUeryEx was the same as the architecture of my program, despite that of the target. I want to make sure I am parsing the information from VirtualQueryEx correctly. Do I really need to specify the version of MEMORY_BASIC_INFORMATION I am using to match the architecture of the target? If so, why is VirtualQueryEx returning only the version of my program's architecture and how can I get around that?

推荐答案

根据我的经验，最好的解决方案是使用常规宏 MEMORY_BASIC_INFORMATION 并为 x86 和 x64 构建单独的可执行文件.此外，对所有地址、偏移量和指针使用宏，这些地址、偏移量和指针会根据您构建的体系结构解析为正确的大小.然后根据目标进程的架构使用相应的可执行文件.这将导致最少的头痛.

In my experience, the best solution is to use the regular macro MEMORY_BASIC_INFORMATION and to build separate executable for x86 and x64. In addition use a macro for all addresses, offsets and pointers that resolve for the correct size depending on what architecture you build for. Then use the corresponding executable based on the target process's architecture. This will lead to the least amount of headache.

在这种情况下，如果您使用来自 x64 进程的 MEMORY_BASIC_INFORMATION 并以 x86 或 x64 进程为目标，它应该可以正常工作.但我不认为这适用于所有结构和 Windows API 函数，因为这只会让您在路上遇到麻烦，这就是我推荐上述方法的原因.

In this case, if you use MEMORY_BASIC_INFORMATION from a x64 process and target a x86 or x64 process it should work fine. But I wouldn't assume this to work with all structures and Windows API functions as that will only get you in trouble down the road which is why I recommend the above method.

这篇关于MEMORY_BASIC_INFORMATION 和 VirtualQueryEx 在不同架构上的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！