问题
The MSDN page for MEMORY_BASIC_INFORMATION points out in the remarks section that MEMORY_BASIC_INFORMATION32 and MEMORY_BASIC_INFORMATION64 should be specified in situations where the target process is running on a different architecture than the querying program (when using VirtualQueryEx). I also found some SO posts which pointed this out in their answers to related questions. I discovered though that the version of MEMORY_BASIC_INFORMATION I was being passed by VirtualQUeryEx was the same as the architecture of my program, despite that of the target. I want to make sure I am parsing the information from VirtualQueryEx correctly. Do I really need to specify the version of MEMORY_BASIC_INFORMATION I am using to match the architecture of the target? If so, why is VirtualQueryEx returning only the version of my program's architecture and how can I get around that?
回答1:
In my experience, the best solution is to use the regular macro MEMORY_BASIC_INFORMATION and to build separate executable for x86 and x64. In addition use a macro for all addresses, offsets and pointers that resolve for the correct size depending on what architecture you build for. Then use the corresponding executable based on the target process's architecture. This will lead to the least amount of headache.
In this case, if you use MEMORY_BASIC_INFORMATION from a x64 process and target a x86 or x64 process it should work fine. But I wouldn't assume this to work with all structures and Windows API functions as that will only get you in trouble down the road which is why I recommend the above method.
来源：https://stackoverflow.com/questions/60837275/memory-basic-information-and-virtualqueryex-on-different-architectures