A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about user-mode development.
 #8058  by Brock
 Tue Aug 16, 2011 8:46 pm
@EP_X0FF Not sure but I think Juan is confusing memory region size with size of bytes to modify (2 NOPs)

@Juan Base address is where the region of memory begins, region size will be divisible by PAGE_SIZE. On x86 typically this is 4096 bytes and can be dynamically obtained through GetSystemInfo->dwPageSize

P.S: Juan, you can use VirtualQuery on that address and in your MEMORY_BASIC_INFORMATION variable look at the struct member AllocationBase, it will be the base address.
 #8588  by juan81
 Fri Sep 16, 2011 1:12 pm
Brock wrote:@EP_X0FF Not sure but I think Juan is confusing memory region size with size of bytes to modify (2 NOPs)

@Juan Base address is where the region of memory begins, region size will be divisible by PAGE_SIZE. On x86 typically this is 4096 bytes and can be dynamically obtained through GetSystemInfo->dwPageSize

P.S: Juan, you can use VirtualQuery on that address and in your MEMORY_BASIC_INFORMATION variable look at the struct member AllocationBase, it will be the base address.
tq for replay... i have trace it, Hackshield protect mapping on that address so that function always fail... i have use another way to change that memory region...