How do I get the information shown in vmmap programatically?

二次信任 提交于 2019-12-06 09:01:52

I used the Dependency Walker to look at which Windows API functions were imported from Kernel32.dll by vmmap.exe and found the following functions which are probably relevant:

VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtectEx
VirtualQueryEx

Take a look at those and see if you can find what vmmap is doing. Of course any other API calls made dynamically (i.e. via LoadLibrary) would not show up in the dependency walker. It's also known to be broke when dealing with side-bys-de loaded DLLs.

There is an open-source command-line implementation of VMMap-like functionality in twpol/vmmap, and it successfully shows all of the same information about a process that SysInternals VMMap does.

See also this fork which implements fast heap enumeration, but I haven't personally tested this one.

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!