Region Size Incorrect ? about memprocfs HOT 10 CLOSED

hmm, the length checks out for me, or am I missing something?
0x8000 == 32kB
0x80000 == 512kB

also (not related in any way) I noticed that stacks aren't showing up in your sample, if you put the microsoft binaries dbghelp.dll and symsrv.dll (included in binary package) alongside vmm.dll and also initialize vmm.dll with additional option -waitinitialize MemProcFS will download required symbol files from Microsoft server and parse threads as well.

from memprocfs.

i am enumerating the memory regions like this -> https://pastebin.com/NFgsBVzT

from memprocfs.

yes, but region sizes checks out in the image you posted.

process hacker shows 32kB for address 0x470000 and MemProcFS 0x8000. 0x8000 = 32kB

from memprocfs.

you're right, but when i use VirtualQueryEx i see more pages and different region sizes.

from memprocfs.

i tought VMMDLL_ProcessMap_GetVad was supposed to give me the same information as VirtualQueryEx, or am I missing something ?

you're right, but when i use VirtualQueryEx i see more pages and different region sizes.

from memprocfs.

I haven't tested it against VirtualQueryEx, but MemProcFS should be returning the size of the whole VAD, while I suspect VirtualQueryEx may return only committed (i.e. not reserved) pages? could that be the issue?

In the VMMDLL_MAP_VADENTRY struct there is a field CommitCharge and MemCommit. Does the CommitCharge corresponds to VirtualQueryEx?

Also, I currently have no notion about which parts of the VAD is commited, it's a thing that would be nice to add for the future I guess?

from memprocfs.

Hmm, when looking at your example you have two regions in the same VAD. I'll have to add support for querying sub-regions within a VAD for this to work as you wish. It would be a good thing to do and I'll put it on the todo list. So it's not a bug, it's more of a feature request.

from memprocfs.

Hmm, when looking at your example you have two regions in the same VAD. I'll have to add support for querying sub-regions within a VAD for this to work as you wish. It would be a good thing to do and I'll put it on the todo list. So it's not a bug, it's more of a feature request.

I see, it would be great to have something that works like VirtualQueryEx or something else that gives the same information.

from memprocfs.

Anyway, thanks for reporting this. I'll try to add support for sub-regions in the future. Hopefully I'll get to it sooner than later. I'll put it down as enhancement.

I'll probably add a flag in the VMMDLL_MAP_VADENTRY struct that there exists sub-regions and you'll have to query via separate API call.

from memprocfs.

I have decided not to add this since there is already functionality that will do the job. sort of.

If you have a VAD region which is marked as "private" and you wish to know which pages are readable in there please retrieve the PTE map (which is gathered by walking the page tables) and check the memory addresses for the VAD region.

This will mostly give the correct answer already; the result may be a bit shaky if some of the memory pages are paged out right now; this will be fixed in the next version that will be released this or next month (i.e. PTE map will contain paged-out memory regions as well).

from memprocfs.