使用page_guard保护监控内存更改

时间:2017-01-08 20:13:02

标签: winapi memory-address

有一个特定的内存区域(DWORD值)不断变化,我想跟踪这些变化。

我决定用PAGE_GUARD保护该地区,以便我知道何时访问该地区:

int main(void)
{
    SetUnhandledExceptionFilter(exception_filter);

    //The memory region I want to monitor
    DWORD* addr= (DWORD*)0x00B8CFD0;

    //Add page guard protection
    DWORD oldProtection;
    if (!VirtualProtect(addr, sizeof(DWORD), PAGE_READWRITE | PAGE_GUARD, &oldProtection))
        return 1;

    //The exception will occur and at this point I know the memory was accessed
    *addr = 1000;

    return 0;
}

LONG WINAPI exception_filter(PEXCEPTION_POINTERS pExcepPointers)
{
    if(pExcepPointers->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION)
    {
        //the memory region is being accessed
        //but how can I track the new modification?
    }

    return EXCEPTION_CONTINUE_EXECUTION;
}

这很好,但是,我想从exception_filter中读取新值(在本例中为1000)。那可能吗?

我已经尝试过pExcepPointers的所有财产,到目前为止还没有任何相关内容。

0 个答案:

没有答案
相关问题