通过VirtualQuery查询当前进程虚拟内存使用情况

函数原型：

SIZE_T WINAPI VirtualQuery(
  _In_opt_ LPCVOID                   lpAddress,
  _Out_    PMEMORY_BASIC_INFORMATION lpBuffer,
  _In_     SIZE_T                    dwLength
);

源代码：

#include
#include
/**
*   
	数据类型总结：
	BSTR:OLECHAR * 类型的Unicode字符串，时一个COM字符串，带长度前缀。
	LPSTR: char*,指向以"\0"结尾的8位（单字节）ANSI字符数组指针
	LPWSTR: wchar_t *,指向以 "\0"结尾的16位（双字节）Unicode字符数组指针
	LPCSTR: const char *
	LPCWSTR:  const wchar_t*
	LPTWSTR:  LPSTR,LPWSTR二选一，取决于 宏是否定义 ASNSI,Unicode
	相互转换的方法：
	LPWSTR->LPSTR: W2T()
	LPTSRT->LPWSTR :  T2W()
	LPCWSTR->LPCSTR:W2CT()
	LPCSTR->LPCWSTR:T2CW()
	ANSI->UNICODE:A2W()
	UNICODE->ANSI:W2A()
	------------------------------
	输出宽字符(Unicode)的正确方式：
	wchar_t buf[100]=L"123";
    printf("%ls",buf)
**/
int main(int argc, char * argv[])
{
	LPCVOID pAddress = 0x00;
	MEMORY_BASIC_INFORMATION memInfo;
	char Type[10];
	char Protect[10];
	wchar_t dlpath[1024];
	while (VirtualQuery(pAddress, &memInfo, sizeof(memInfo)) != 0)
	{
		ZeroMemory(Type, 10);
		ZeroMemory(Protect, 10);
		ZeroMemory(dlpath, 1024);
		printf("基地址：0x%p  |", memInfo.BaseAddress);
		if (memInfo.State == MEM_FREE)
		{
			sprintf(Type, "FREE");
		}
		else if (memInfo.Type == MEM_IMAGE)
		{
			sprintf(Type, "Image");
		}
		else if (memInfo.Type == MEM_MAPPED)
		{
			sprintf(Type, "mapped");
		}
		else if (memInfo.Type==MEM_PRIVATE)
		{
			sprintf(Type, "private");
		}
		printf("  %s  |", Type);
		printf("  %d  |", memInfo.RegionSize);
		if (memInfo.AllocationProtect == PAGE_READONLY)
		{
			sprintf(Protect, "_R_");
		}else if (memInfo.AllocationProtect == PAGE_READWRITE)
		{
			sprintf(Protect, "_RW_");
		}else if (memInfo.AllocationProtect == PAGE_EXECUTE)
		{
			sprintf(Protect, "_E_");
		}
		else if (memInfo.AllocationProtect == PAGE_EXECUTE_READWRITE)
		{
			sprintf(Protect, "_ERW_");
		}else if (memInfo.AllocationProtect == PAGE_EXECUTE_READ)
		{
			sprintf(Protect, "_ER_");
		}else if (memInfo.AllocationProtect == PAGE_EXECUTE_WRITECOPY)
		{
			sprintf(Protect, "_ERC_");
		}
		printf("  %s  |", Protect);
		if (memInfo.AllocationProtect==PAGE_EXECUTE_WRITECOPY)
		{
			DWORD r=GetModuleFileName((HMODULE)memInfo.AllocationBase, dlpath, sizeof(dlpath));	
		}
	
		printf("  %ls ", dlpath);
		printf("\n");//换行
		pAddress = (PVOID)((PBYTE)pAddress + memInfo.RegionSize);//指针运算 先转PBYTE是因为 RegionSize是Byte
	}
	
	while (1);
}

注意：1.这里是根据 RegionSize每次查询下一个区域的 位置，直到VirtualQuery 返回值为0.

   2.还需要注意的是 LPWSTR是宽字符指针（Unicode），也就是wchar_t 指针，需要 %ls 格式化输出。。