dcsimg
Results 1 to 9 of 9

Thread: [VB6] - Get information about memory usage.

  1. #1

    Thread Starter
    Frenzied Member
    Join Date
    Feb 2015
    Posts
    1,529

    [VB6] - Get information about memory usage.

    This example is intended for retrieving the information about memory usage. This project is compatible with x64 environment.

    The information is based on the GetProcessMemoryInfo function for 32 bit processes. This function has the disadvantage such you can't get correct information for 64 bit processes. The 64-bit approach is based on the internal structure of the GetProcessMemoryInfo function which just calls the NtQueryInformationProcess one with
    the ProcessVmCounters type information.

    Because of this function goes thru WoW64 layer we also can't extract the correct information. To avoid this i used switching to x64 (Long-Mode) and calling the appropriate function in the 64-bit ntdll. Therefore we have no WoW64 layer and can extract the correct information.

    I've added the useful module to working with 64-bit ntdll (and others dlls). You can call the most of functions in 64-bit dlls using CallX64 function. Notice, all the pointers in x64 are 64-bit one so you need to pass them as a Currency variable if you want to work with other 64-bit applications. If you work with 32-bit applications you can pass usual pointers (like VarPtr casted to Long) because they are expanded to 64-bit ones with the zeroed high part.

    GetModuleHandle64 allows to get a handle of a 64-bit library in the current process by its name.

    GetProcAddress64 allows to get the address of function from a 64-bit dll in the current process (it has not-full functional because it doesn't support redirects but i don't know imagine a situation when it can be applicable in the current mode). I didin't checked but i think you can load another 64-bit dll to the current process but it should use only the Native APIs.

    Project on GitHub.

  2. #2

  3. #3
    Addicted Member
    Join Date
    Jun 2016
    Location
    Espaņa
    Posts
    132

    Re: [VB6] - Get information about memory usage.

    The trick hi
    Example I does not work.
    pid column completed successfully, but the other columns 0kb.
    Use 64bit windows 10, 8176 version vb6.
    I have not installed the servi pack 3

    Greetings

  4. #4

    Thread Starter
    Frenzied Member
    Join Date
    Feb 2015
    Posts
    1,529

    Re: [VB6] - Get information about memory usage.

    yokesee,
    Thank you for debugging. I've found the error and fixed it.
    The problem was NtWow64ReadVirtualMemory64 (and maybe others Native APIs) considers the handles as an unsigned value in Win10. Therefore we can't specify -1 pseudohandle (the current process handle) as a handle value because WOW64 expands it as the unsigned value (uses the mov instruction instead movsxd like in Win7/8). To avoid this restriction it uses the real handle obtained from OpenProcess.
    Win7:
    Name:  win7.jpg
Views: 141
Size:  20.7 KB
    Win10:
    Name:  win10.jpg
Views: 142
Size:  32.7 KB

  5. #5
    Addicted Member
    Join Date
    Jun 2016
    Location
    Espaņa
    Posts
    132

    Re: [VB6] - Get information about memory usage.

    very good work.
    I'm not sure if the data is correct.
    in the task manager mark something else.
    later I'll look more

    Greetings

  6. #6
    Addicted Member
    Join Date
    Jan 2015
    Posts
    195

    Re: [VB6] - Get information about memory usage.

    If Not modX64Call.Initialize() Then
    MsgBox "Unable to initialize x64caller", vbCritical
    End If
    Dim hSendMessage As Currency
    hSendMessage = GetProcAddress64(GetModuleHandle64("user32.dll"), "SendMessageW")
    hSendMessage return 0 without msgbox popup

    env. win10 x64 vb6 sp6


    By the way, can we get to support x64 process calling x32 dlls?
    maybe this will be used for 64bit office to call vb6 written dlls
    Last edited by loquat; Mar 26th, 2020 at 10:20 AM.

  7. #7

    Thread Starter
    Frenzied Member
    Join Date
    Feb 2015
    Posts
    1,529

    Re: [VB6] - Get information about memory usage.

    loquat before you use a dll you should load it.
    A Wow64 process has only 64 bit ntdll loaded in the current process so you can use only 64-bit NativeAPI functions.
    The second note is you probably can't load 64-bit kernel32/kernelbase to current process so you can use ONLY NativeAPI.

    By the way, can we get to support x64 process calling x32 dlls?
    maybe this will be used for 64bit office to call vb6 written dlls
    You can switch to 32-bit mode but you probably can't use dlls. There is other way to use VB6-dlls in 64 Bit processes by DllSurrogate.

  8. #8
    Addicted Member
    Join Date
    Jan 2015
    Posts
    195

    Re: [VB6] - Get information about memory usage.

    i m curious, can this technique be used for vb6 by writing a library dll?
    http://blog.rewolf.pl/blog/?p=102

  9. #9

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Featured


Click Here to Expand Forum to Full Width