Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Question on querying memory regions

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
DanyDollaro
Master Cheater
Reputation: 2

Joined: 01 Aug 2019
Posts: 312

PostPosted: Sat May 02, 2020 1:49 pm    Post subject: Question on querying memory regions Reply with quote

Hi, I had written a program that enumerates all the memory regions of a process with the following attributes: MEM_COMMIT and PAGE_READWRITE, and that at the end of the program prints the total size of all the regions found, everything seems to work well, then I tried it on programs at 64 bits and it turned out that the total regions size was greater than the RAM available on my PC.
On my PC there are 15.9GB of RAM available while one of the scans that I made was 18.363.846.656 Byte (18.3 GB).
I wonder, how is it possible? is it a mistake in my code, or are they using some memory management methods that I am not aware of?

Code:
#include <iostream>
#include <Windows.h>

int main()
{
        // Get an handle to the process
   HWND hWnd = FindWindowA(NULL, "WindowName");
   DWORD pid; GetWindowThreadProcessId(hWnd, &pid);
   HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

        // Declaration of some variables
   char* Ptr(0);
   MEMORY_BASIC_INFORMATION Mem;
   size_t totalSize = 0;

        // Start querying
   while (VirtualQueryEx(hProcess, Ptr, &Mem, sizeof(MEMORY_BASIC_INFORMATION)))
   {
      if (Mem.State == MEM_COMMIT && Mem.Protect == PAGE_READWRITE)
      {
         totalSize += Mem.RegionSize;
         std::cout << std::hex << Mem.BaseAddress << " - " << (LPVOID)(Mem.RegionSize + (INT64)Mem.BaseAddress) << " - size:(" << std::dec << Mem.RegionSize << ")\n";
      }
      
      Ptr += Mem.RegionSize;
   }

   std::cout << "[" << totalSize << "]";
   CloseHandle(hProcess);
   return 0;
}
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 392

Joined: 09 May 2003
Posts: 23316
Location: The netherlands

PostPosted: Sun May 03, 2020 1:12 am    Post subject: Reply with quote

Nothing wrong with using more Virtual Memory than you have Physical Memory. The stuff that is too much gets written to the windows pagefile until accessed again.
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
DanyDollaro
Master Cheater
Reputation: 2

Joined: 01 Aug 2019
Posts: 312

PostPosted: Sun May 03, 2020 8:10 am    Post subject: Reply with quote

Oh thank you Dark Byte now makes more sense, I thought I was scanning only the physical memory Surprised.
Could you give me some advice on how to consider only the regions allocated in physical memory? I think I have to use an API other than VirtualQueryEx
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 392

Joined: 09 May 2003
Posts: 23316
Location: The netherlands

PostPosted: Sun May 03, 2020 9:59 am    Post subject: Reply with quote

Windows doesn't really provide a way to do that, just a total number of actual allocated physical memory.

You can of course go into kernelmode and query the pages yourself. Or use CE's driver(selfcompile it) as it's virtualqueryEx implementation only counts physical memory

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
DanyDollaro
Master Cheater
Reputation: 2

Joined: 01 Aug 2019
Posts: 312

PostPosted: Sun May 03, 2020 10:32 am    Post subject: Reply with quote

Thanks for everything Dark Byte Smile
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites