NtQueryVirtualMemory issue/fix

[med0x2e]

Hi,

I've been trying to get NtQueryVirtualMemory to work in a sample x64 PoC with the current generated NQVM prototype; the call to NQVM keep failing with "0xc0000005" error code.

the current generated prototype:

NTSTATUS status = NtQueryVirtualMemory(hProcess, (PVOID)p_addr, MemoryBasicInformation, &memInfo, sizeof(memInfo), &retBytes);
		
EXTERN_C NTSTATUS NtQueryVirtualMemory(
	IN HANDLE ProcessHandle,
	IN PVOID BaseAddress,
	IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
	OUT PVOID MemoryInformation,
	IN ULONG MemoryInformationLength, <====
	OUT PULONG ReturnLength OPTIONAL);

I had to change the "MemoryInformationLength" type to ULONG_PTR (unsigned long long) to get it working;

NTSTATUS status = NtQueryVirtualMemory(hProcess, (PVOID)p_addr, MemoryBasicInformation, &memInfo, sizeof(memInfo), &retBytes);
		

EXTERN_C NTSTATUS NtQueryVirtualMemory(
	IN HANDLE ProcessHandle,
	IN PVOID BaseAddress,
	IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
	OUT PVOID MemoryInformation,
	IN ULONG_PTR MemoryInformationLength, <<====
	OUT PULONG ReturnLength OPTIONAL);

OS: Windows 10
Build Number: 18363

[jthuraisamy]

Thanks for the feedback @med0x2e. I've changed the types for MemoryInformationLength and ReturnLength to SIZE_T and PSIZE_T as per documentation here. Let me know if this causes issues, thanks!

[med0x2e]

Tested your fix & worked as well.

Thanks :)

[jthuraisamy]

Glad it worked; thanks for reporting this issue!