PE截面特性的识别

Question

I need to identify, whether a given pointer is a pointer to a writable or non-writable memory. I think, it might be identified by that the pointer points to a PE section, and the section has not the IMAGE_SCN_MEM_WRITE flag set.

Is there any simple way, how to obtain the section characteristic based on just pointer? (I don't want to parse the PE in runtime, I expect, there is some direct way.

Answer 1

VirtualQuery will give you the required information, if the PE file has been loaded into memory. It doesn't make sense to have a pointer to something that's not loaded in memory, so this is probably sufficient for your purpose.

Since VirtualQuery works on pages, round down the pointer to the previous page boundary, and set the length to check to just one page.