ReadProcessMemoryVlm

[This is preliminary documentation and subject to change.]

The ReadProcessMemoryVlm function reads memory in a specified process.

BOOL ReadProcessMemoryVlm(
  HANDLE hProcess,  // handle to the process whose memory is read
  PVOID64 lpBaseAddress,
                    // address to start reading
  PVOID64 lpBuffer, // address of buffer to place read data
  DWORD nSize,      // number of bytes to read
  LPDWORD lpNumberOfBytesRead 
                    // address of number of bytes read
);
 

Parameters

hProcess

Handle to the process whose memory is being read. To obtain a handle to a process, use the OpenProcess function. The handle must have PROCESS_VM_READ access to the process set when the process is opened.

lpBaseAddress

Pointer to the base address in the specified process to read. Before any data transfer occurs, the operating system verifies that all data in the base address and memory of the specified size is accessible for reading. If this is the case, the function proceeds; otherwise, the function fails. The address specified is 64 bits and can therefore be used to access memory in the process allocated using VirtualAllocVlm, or the address can be a sign-extended 32-bit address.

lpBuffer

Pointer to a buffer that receives the contents from the address space of the specified process.

nSize

Number of bytes to read from the specified process.

lpNumberOfBytesRead

Pointer to the actual number of bytes transferred into the specified buffer. If the lpNumberOfBytesRead parameter is NULL, it is ignored.

Return Values

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

ReadProcessMemoryVlm fails if the requested operation attempts to read an area of the process that is inaccessible. In that event, no data is transferred.

Remarks

ReadProcessMemoryVlm copies the data in the specified address range from the address space of the specified process into the specified buffer of the current process. Any process that has a handle with PROCESS_VM_READ access can call ReadProcessMemoryVlm. The process whose address space is read is typically, but not necessarily, being debugged.

The entire area to be read in a call to ReadProcessMemoryVlm must be accessible, or the function fails.

Note  To guard against an access violation, use structured exception handling to protect any code that writes to or reads from a memory-mapped view. For more information on structured exception handling, see Reading and Writing.

QuickInfo

  Windows NT: Requires version 5.0 or later.
  Windows: Unsupported.
  Windows CE: Unsupported.
  Header: Declared in winbase.h.
  Import Library: Use kernel32.lib.

See Also

Memory Management Overview, Memory Management Functions, Very Large Memory (VLM), OpenProcess, VirtualAllocVlm, WriteProcessMemoryVlm