Skip to content

wow64: Handle regions extending pass the address limit in NtQueryVirtualMemory.

There are regions of virtual memory that start below the WoW user address limit but end beyond it (e.g. a large empty region between the end of 32-bit allocations and 64-bit ntdll). When queried from WoW via NtQueryVirtualMemory(MemoryBasicInformation), the returned struct for such a region will have BaseAddress + RegionSize past the highest user address (or even worse - it may overflow 32 bits). These patches make WoW NtQueryVirtualMemory report a truncated size for such regions, so that they appear to end exactly at the highest user address. This fixes programs that, e.g., walk their address space using iterated calls to VirtualQuery.

Also, make MemoryRegionInformation queries return STATUS_INVALID_PARAMETER when passed an address beyond the user address limit, like MemoryBasicInformation already does.

Merge request reports

Loading