通过VirtualQuery查询当前进程虚拟内存使用情况

函数原型：

SIZE_T WINAPI VirtualQuery(
_In_opt_ LPCVOID lpAddress,
_Out_ PMEMORY_BASIC_INFORMATION lpBuffer,
_In_ SIZE_T dwLength
);

源代码：
#include<stdio.h>
#include<Windows.h>
/**
*
数据类型总结：
BSTR:OLECHAR * 类型的Unicode字符串，时一个COM字符串，带长度前缀。
LPSTR: char*,指向以"\0"结尾的8位（单字节）ANSI字符数组指针
LPWSTR: wchar_t *,指向以 "\0"结尾的16位（双字节）Unicode字符数组指针
LPCSTR: const char *
LPCWSTR: const wchar_t*
LPTWSTR: LPSTR,LPWSTR二选一，取决于 宏是否定义 ASNSI,Unicode
相互转换的方法：
LPWSTR->LPSTR: W2T()
LPTSRT->LPWSTR : T2W()
LPCWSTR->LPCSTR:W2CT()
LPCSTR->LPCWSTR:T2CW()
ANSI->UNICODE:A2W()
UNICODE->ANSI:W2A()
------------------------------
输出宽字符(Unicode)的正确方式：
wchar_t buf[100]=L"123";
printf("%ls",buf)
**/
int main(int argc, char * argv[])
{
LPCVOID pAddress = 0x00;
MEMORY_BASIC_INFORMATION memInfo;
char Type[10];
char Protect[10];
wchar_t dlpath[1024];
while (VirtualQuery(pAddress, &memInfo, sizeof(memInfo)) != 0)
{
ZeroMemory(Type, 10);
ZeroMemory(Protect, 10);
ZeroMemory(dlpath, 1024);
printf("基地址：0x%p |", memInfo.BaseAddress);
if (memInfo.State == MEM_FREE)
{
sprintf(Type, "FREE");
}
else if (memInfo.Type == MEM_IMAGE)
{
sprintf(Type, "Image");
}
else if (memInfo.Type == MEM_MAPPED)
{
sprintf(Type, "mapped");
}
else if (memInfo.Type==MEM_PRIVATE)
{
sprintf(Type, "private");
}
printf(" %s |", Type);
printf(" %d |", memInfo.RegionSize);
if (memInfo.AllocationProtect == PAGE_READONLY)
{
sprintf(Protect, "_R_");
}else if (memInfo.AllocationProtect == PAGE_READWRITE)
{
sprintf(Protect, "_RW_");
}else if (memInfo.AllocationProtect == PAGE_EXECUTE)
{
sprintf(Protect, "_E_");
}
else if (memInfo.AllocationProtect == PAGE_EXECUTE_READWRITE)
{
sprintf(Protect, "_ERW_");
}else if (memInfo.AllocationProtect == PAGE_EXECUTE_READ)
{
sprintf(Protect, "_ER_");
}else if (memInfo.AllocationProtect == PAGE_EXECUTE_WRITECOPY)
{
sprintf(Protect, "_ERC_");
}
printf(" %s |", Protect);
if (memInfo.AllocationProtect==PAGE_EXECUTE_WRITECOPY)
{
DWORD r=GetModuleFileName((HMODULE)memInfo.AllocationBase, dlpath, sizeof(dlpath));
}

printf(" %ls ", dlpath);
printf("\n");//换行
pAddress = (PVOID)((PBYTE)pAddress + memInfo.RegionSize);//指针运算 先转PBYTE是因为 RegionSize是Byte
}

while (1);
}

注意：1.这里是根据 RegionSize每次查询下一个区域的 位置，直到VirtualQuery 返回值为0.
   2.还需要注意的是 LPWSTR是宽字符指针（Unicode），也就是wchar_t 指针，需要 %ls 格式化输出。。