How to find if an address belongs to the code or data sections

Question

Given an address I want to find at runtime without access the PE header on disk if it belongs to the .text section (Is there any other executable section?).
More details:
The address is in the same process that I'm running but it can be form a different dll static library or the executable that runs the process.
I'm running on windows using VS2010 Win32.

Answer 1

You want VirtualQuery . It fills in a MEMORY_BASIC_INFORMATION structure. If mbi.Type == MEM_IMAGE , you're looking at a mapped image. You probably also want to look at the AllocationProtect to check for PAGE_EXECUTE or one of its variants (otherwise you could be looking at something like read-only data mapped from the executable, such as a bitmap resource or something on that order).

Answer 2

Consider DbgHelp API: http://msdn.microsoft.com/en-us/library/ms679292(v=vs.85 )

For example,

EnumerateLoadedModulesEx gives you information on loaded modules with base addresses and sizes (so you can id the module)

MapDebugInformation retrieves information about module's sections