Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


QueryVirtualMemory api vs dbk_QueryVirtualMemory

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
CatNoCat
How do I cheat?
Reputation: 0

Joined: 23 Feb 2024
Posts: 2

PostPosted: Fri Feb 23, 2024 12:49 pm    Post subject: QueryVirtualMemory api vs dbk_QueryVirtualMemory Reply with quote

Hello,
What is the difference between QueryVirtualMemory and dbk_QueryVirtualMemory?
Is dbk_QueryVirtualMemory just using ZwQueryVirtualMemory from kernel mode?
Thanks ahead
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25280
Location: The netherlands

PostPosted: Fri Feb 23, 2024 1:23 pm    Post subject: Reply with quote

dbk_QueryVirtualMemory scans the pagetable layout of the target process(cr3 register) and builds a results that matcjes the result of virtualQueryEx

this is why it can't scan memory that is paged out , which shouldn't be an issue most of the time as usually you scan for things that are actively used by game

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
CatNoCat
How do I cheat?
Reputation: 0

Joined: 23 Feb 2024
Posts: 2

PostPosted: Fri Feb 23, 2024 2:17 pm    Post subject: Reply with quote

Thank your for your response.
I'm asking because I'm not gettin a result that matches NtVirtualQuery.
When scanning the memory regions with NtQueryVirtualMemory I got the following results:
address, AllocatopnProtect, State, Protect, Type, Size
7ff60c510000 Execute+Read, Commit, Execute+Read, Mapped, 1DD0000

When scanning memory regions with dbg_QueryVirtualMemory I got the results of:
address, AllocatopnProtect, State, Protect, Type, Size
7ff60c510000 Execute+Read, Commit, Execute+Read, Private, 1DD3000

So, I'm wondering why the results are not the same...
Do you have any assumption why the region size may differ when using dbg_QueryVirtualMemory?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25280
Location: The netherlands

PostPosted: Fri Feb 23, 2024 3:47 pm    Post subject: Reply with quote

as i said in my previous post, it only finds paged in memory. If a block has been paged out to disk it won't be found. (E.g if the function you're interested in hasn't been executed yet, it may not be present in RAM yet)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites