{"id":344,"date":"2012-05-08T23:14:24","date_gmt":"2012-05-08T21:14:24","guid":{"rendered":"http:\/\/blog.rewolf.pl\/blog\/?p=344"},"modified":"2013-06-28T16:55:42","modified_gmt":"2013-06-28T14:55:42","slug":"wow64ext-library-update","status":"publish","type":"post","link":"http:\/\/blog.rewolf.pl\/blog\/?p=344","title":{"rendered":"wow64ext library update"},"content":{"rendered":"<p>I&#8217;ve updated <strong>wow64ext<\/strong> library, there are two new functions:<\/p>\n<ul>\n<li><strong>VirtualAllocEx64<\/strong><\/li>\n<li><strong>VirtualFreeEx64<\/strong><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Those are equivalent of standard <strong>VirtualAllocEx<\/strong> and <strong>VirtualFreeEx<\/strong>, but works with 64-bits addresses. There is additional source code provided in <a href=\"http:\/\/code.google.com\/p\/rewolf-wow64ext\/source\/browse\/sample\/main.cpp\" target=\"_blank\">\\sample\\main.cpp<\/a> that shows how to use those new functions:<\/p>\n<pre lang=\"cpp\" line=\"1\">printf(\"Alloc\/Free test:\\nRequesting 0x1000 bytes of memory at 0x70000020000 ...\\n\");\r\nDWORD64 mem = VirtualAllocEx64(hProcess, 0x70000020000, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);\r\nif (0 == mem)\r\n{\r\n\tprintf(\"VirtualAllocEx64 failed.\\n\");\r\n\tCloseHandle(hProcess);\r\n\treturn 0;\r\n}\r\nprintf(\"Memory allocated at: %016I64X\\n\", mem);\r\n\r\nVirtualQueryEx64(hProcess, mem, &mbi64, sizeof(mbi64));\r\nprintf(\"Query memory: %016I64X %016I64X %08X %08X %08X\\n\", mbi64.BaseAddress, mbi64.RegionSize, mbi64.Protect, mbi64.Type, mbi64.State);\r\nprintf(\"Freeing memory: %s\\n\", VirtualFreeEx64(hProcess, mem, 0, MEM_RELEASE) ? \"success\" : \"failure\");\r\nVirtualQueryEx64(hProcess, mem, &mbi64, sizeof(mbi64));\r\nprintf(\"Query memory: %016I64X %016I64X %08X %08X %08X\\n\", mbi64.BaseAddress, mbi64.RegionSize, mbi64.Protect, mbi64.Type, mbi64.State);<\/pre>\n<p>After successful execution it will show that both new functions works perfectly:<br \/>\n<code><br \/>\nAlloc\/Free test:<br \/>\nRequesting 0x1000 bytes of memory at 0x70000020000 ...<br \/>\nMemory allocated at: 0000070000020000<br \/>\nQuery memory: 0000070000020000 0000000000001000 <font color=\"green\">00000004<\/font> 00020000 <font color=\"yellow\">00001000<\/font><br \/>\nFreeing memory: success<br \/>\nQuery memory: 0000070000020000 000000FEF5050000 <font color=\"green\">00000001<\/font> 00000000 <font color=\"yellow\">00010000<\/font><br \/>\n<\/code><\/p>\n<p>green values are <em>memory protection<\/em> flags:<\/p>\n<ul>\n<li>00000004 &#8211; <strong>PAGE_READWRITE<\/strong><\/li>\n<li>00000001 &#8211; <strong>PAGE_NOACCESS<\/strong><\/li>\n<\/ul>\n<p>yellow values represents state of memory pages:<\/p>\n<ul>\n<li>00001000 &#8211; <strong>MEM_COMMIT<\/strong><\/li>\n<li>00010000 &#8211; <strong>MEM_FREE<\/strong><\/li>\n<\/ul>\n<p>Link to library hosted on google code: <a href=\"http:\/\/code.google.com\/p\/rewolf-wow64ext\/\">http:\/\/code.google.com\/p\/rewolf-wow64ext\/<\/a><br \/>\nDirect link to zip package: <a href=\"http:\/\/rewolf-wow64ext.googlecode.com\/files\/rewolf.wow64ext.zip\" target=\"_blank\">http:\/\/rewolf-wow64ext.googlecode.com\/files\/rewolf.wow64ext.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve updated wow64ext library, there are two new functions: VirtualAllocEx64 VirtualFreeEx64 Those are equivalent of standard VirtualAllocEx and VirtualFreeEx, but works with 64-bits addresses. There is additional source code provided in \\sample\\main.cpp that shows how to use those new functions: printf(&#8220;Alloc\/Free test:\\nRequesting 0x1000 bytes of memory at 0x70000020000 &#8230;\\n&#8221;); DWORD64 mem = VirtualAllocEx64(hProcess, 0x70000020000, 0x1000, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[10,5,16,11],"tags":[],"_links":{"self":[{"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/posts\/344"}],"collection":[{"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=344"}],"version-history":[{"count":20,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/posts\/344\/revisions"}],"predecessor-version":[{"id":669,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=\/wp\/v2\/posts\/344\/revisions\/669"}],"wp:attachment":[{"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=344"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.rewolf.pl\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}