I am using winxp and intel processor ,

How do i access all the pages that are allocated to a process at that instance of time
i have the no of pages allocated ,

i want to read that values form those pages and examine them,
How do i get the starting page of a process in the memory ?
Posted on 2006-05-27 16:39:32 by tofani_chokro
If it's your process then you should have the handles to those pages returned via *alloc functions, or whatever.
Posted on 2006-05-27 18:05:51 by ti_mo_n
tofani, can you elaborate a bit?

Are you trying to do this for your own process, or some other running process? If you're trying to do it for some other process, please let us know why so we can decide what to do with this thread.
Posted on 2006-05-27 18:57:51 by f0dder
Its a another process ,
I mean a different process say 'x' , whose handle is know or even its Pid

Typically suspend that process 'x' and then i need to investigate the pages that are there in the Memory and what value they have , other information about how long are they are read or written by that process , basically concerned with the idle ness of the pages in the memory

does this help ?
Posted on 2006-05-28 12:26:09 by tofani_chokro
Hm, basically, see if the information you need is available through perfmon.msc (on NT systems: start->run->perfmon.msc - for 9x systems, who cares :P). If it's not available, then you probably won't to find it anyway.

So, why do you need to do this? :)
Posted on 2006-05-28 12:31:04 by f0dder
I am actually trying to analyse a program which is just allocating memory at a constant rate and the allocated memory is not used for a long time ,


int count=1;
  while(count) // infinite loop
    printf_s("Memory Leakage Value= %d allocated  \n",(count++)*sizeof(a));

now in every loop a chunk of memory is allocated ,and is not used again ,
and if the process doesn't terminate then the memory is not released back

so my intension is to find a way to solve this problem

i am clear ?
Posted on 2006-05-28 12:54:13 by tofani_chokro
The following code will require some minor modification to suit yourself, and is only a simple example, and is not the fastest way there is.

MapProcessMemory proc hprocess
LOCAL p,guard,nocache
    mov p,NULL

invoke VirtualQueryEx,hprocess,p,addr info,sizeof info
        .break .if eax!=sizeof info
        DbgHex info.BaseAddress
        DbgDec info.RegionSize

        Switch info.State
        Case MEM_COMMIT
            DbgText "Committed"     
        Case MEM_RESERVE
            DbgText "Reserved"
        Case MEM_FREE
            DbgText "Free"         

        Switch info.Type
        Case MEM_IMAGE
            DbgText "Code Module"
        Case MEM_MAPPED:
            DbgText "Mapped    "
        Case MEM_PRIVATE:
            DbgText "Private    "

        mov guard , 0
        mov nocache , 0
mov eax,info.AllocationProtect
        .if eax!=0
            mov nocache , 1
mov eax,info.AllocationProtect
and eax,PAGE_GUARD
        .if eax!=0
            mov guard , 1

        and info.AllocationProtect,NOT (PAGE_GUARD or PAGE_NOCACHE)

        Switch info.AllocationProtect
        Case PAGE_READONLY
            DbgText "Read Only"
            DbgText "Read/Write"
            DbgText "Copy on Write"
        Case PAGE_EXECUTE
            DbgText "Execute only"
            DbgText "Execute/Read"
            DbgText "Execute/Read/Write"
            DbgText "COW Executable"

        .if guard!=0
            DbgText "guard page"
        .if nocache!=0
            DbgText "non-cachable"

mov eax,  info.RegionSize     
add p,eax     
    .until 0
MapProcessMemory endp

Have a nice day :)
Posted on 2006-05-28 18:30:30 by Homer