Changing page permissions

ZwQueryVirtualMemory retrieves information about virtual memory in the user mode

address range.



NTSYSAPI

NTSTATUS

NTAPI

ZwQueryVirtualMemory(

IN HANDLE ProcessHandle,

IN PVOID BaseAddress,

IN MEMORY_INFORMATION_CLASS MemoryInformationClass,

OUT PVOID MemoryInformation,

IN ULONG MemoryInformationLength,

OUT PULONG ReturnLength OPTIONAL

);



Parameters



ProcessHandle

A handle of a process object, representing the process whose virtual memory information

is queried.The handle must grant PROCESS_QUERY_INFORMATION access.



BaseAddress

The base address of the region of pages to be queried.This value is rounded down to

the next page boundary. If the information class requested does not return information

that is specific to a particular address, this parameter may be zero.



MemoryInformationClass

The type of virtual memory information to be queried.The permitted values are

drawn from the enumeration MEMORY_INFORMATION_CLASS, described in the following

section.



MemoryInformation

Points to a caller-allocated buffer or variable that receives the requested virtual

memory information.



MemoryInformationLength

Specifies the size in bytes of MemoryInformation, which the caller should set according

to the given MemoryInformationClass.



ReturnLength

Optionally points to a variable that receives the number of bytes actually returned to

MemoryInformation if the call was successful. If this information is not needed,

ReturnLength may be a null pointer.



typedef enum _MEMORY_INFORMATION_

MemoryBasicInformation,

MemoryWorkingSetList,

MemorySectionName,

MemoryBasicVlmInformation

} MEMORY_INFORMATION_CLASS;