Reading the process memory yields different results

Question

I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided here. However, when I list out the regions in memory, only the pages with RW pages seem to be listed out. More importantly, none of the pages with executable permissions are listed out. How could I rectify this?

Could it have something to do with the privilege at which the process runs?

I've attached a screenshot of the process memory in Ollydbg and what is printed out using the source below :-

int main() {
    HANDLE process = GetCurrentProcess();

    MEMORY_BASIC_INFORMATION info;
    unsigned char *p = NULL;

    for ( p = NULL;
          VirtualQueryEx(process, p, &info, sizeof(info)) == sizeof(info);
          p += info.RegionSize )
    {
        if (info.State == MEM_COMMIT && (info.Type == MEM_MAPPED || info.Type == MEM_PRIVATE))
               printf("%08x %08x %08x\n", info.BaseAddress, info.RegionSize, info.Protect);
    }
}

Answer 1

As far as I remember MEM_MAPPED and MEM_PRIVATE are masks. So it shouldn't be compared for equivalency, it should be checked as (val & MEM_PRIVATE) != 0.

So your code should be corrected as follows:

  int main() {
    HANDLE process = GetCurrentProcess();

    MEMORY_BASIC_INFORMATION info;
    unsigned char *p = NULL;

    for ( p = NULL;
          VirtualQueryEx(process, p, &info, sizeof(info)) == sizeof(info);
          p += info.RegionSize )
    {
        if ((info.State == MEM_COMMIT) && ((info.Type & MEM_MAPPED) || (info.Type & MEM_PRIVATE)))
               printf("%08x %08x %08x\n", info.BaseAddress, info.RegionSize, info.Protect);
    }
}

Hope it helps.

Answer 2

OllyDbg shows memory regions of all types, whereas your code doesn't show MEM_IMAGE regions.

Replace if ((info.State == MEM_COMMIT) && ((info.Type & MEM_MAPPED) || (info.Type & MEM_PRIVATE))) with just if (info.State == MEM_COMMIT).