Get base address of a Process...

[AlbafaN]

Anyone know how to do this? Get the base address of a Process. (I want to loop through all of the process's memory address's and read them using ReadMemoryProcess) I heard I can use VirtualQueryEx, but I cant figure out how to use that... any other ways? or does anyone know how to use VirtualQueryEx?

[jim mcnamara]

These guys do internals. The link is aimed at Pmon which gives information about processes. All of their freeware comes with source code. I would take a quick look at their entire site, especially the white papers section.

Take a look at this code for NT:

http://www.sysinternals.com/ntw2k/freeware/pmon.shtml

[AlbafaN]

Private Type MEMORY_BASIC_INFORMATION
BaseAddress As Long
AllocationBase As Long
AllocationProtect As Long
RegionSize As Long
State As Long
Protect As Long
lType As Long
End Type

Private Declare Function VirtualQueryEx Lib "kernel32" (ByVal hProcess As Long, _
lpAddress As Any, lpBuffer As MEMORY_BASIC_INFORMATION, ByVal dwLength As Long) As Long

Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" _
(ByVal lpClassName As String, ByVal lpWindowName As String) As Long

Private Declare Function GetWindowThreadProcessId Lib "user32" _
(ByVal hWnd As Long, lpdwProcessId As Long) As Long

Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, _
ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Const PROCESS_QUERY_INFORMATION = &H400

Private Sub Command1_Click()
Dim hWnd As Long, pId As Long, pHandle As Long, BaseAddr As Long
Dim MBI As MEMORY_BASIC_INFORMATION

hWnd = FindWindow(vbNullString, "Rainbow Six")

GetWindowThreadProcessId hWnd, pId
pHandle = OpenProcess(PROCESS_QUERY_INFORMATION, False, pId)

VirtualQueryEx pHandle, 0&, MBI, 28
CloseHandle pHandle

BaseAddr = MBI.BaseAddress
Text1.Text = Hex(BaseAddr)
End Sub

-----

Thats what I've come up with so far, but it doesnt seem to be giving me the proper address... Grr, this is one tough api call