NtQueryVirtualMemory

Prototype

NTSTATUS NtQueryVirtualMemory(
  HANDLE                   ProcessHandle,
  PVOID                    BaseAddress,
  MEMORY_INFORMATION_CLASS MemoryInformationClass,
  PVOID                    MemoryInformation,
  SIZE_T                   MemoryInformationLength,
  PSIZE_T                  ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 23 00 00 00      mov eax, 0x23
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtQueryVirtualMemory keeps SSN `0x23` across every Windows 10 / 11 / Server build. It is the kernel side of VirtualQuery / VirtualQueryEx but exposes a much richer information surface: MemoryBasicInformation (state, type, protection), MemoryMappedFilenameInformation (the backing image / data file as an NT path), MemoryRegionInformation (whole VAD subtree info on Win10 1803+), MemoryImageInformation, and MemoryWorkingSetExInformation (per-page valid / locked / shared / shareable bits). Each class maps onto a distinct MmQueryVirtualMemory branch.

Common malware usage

Reconnaissance staple. Enumerate the address space to (a) locate AMSI/ETWTI mapping inside the host process before patching them, (b) find clean PE headers in ntdll/kernel32 for `Perun's Fart`-style fresh-copy unhooking, (c) sweep a remote process for RWX or recently allocated RW regions belonging to a target injection candidate, (d) confirm that a manually mapped image's section was not unmapped by an EDR. MemoryMappedFilenameInformation also lets malware identify EDR DLLs loaded into the host without touching the PEB loader list.

Detection opportunities

High call rates are normal — debuggers, profilers, and even Defender itself walk address spaces continuously. The interesting telemetry is cross-process queries (ProcessHandle != current) from non-instrumentation binaries, especially when followed within milliseconds by NtProtectVirtualMemory or NtWriteVirtualMemory on the same target. ETW Threat Intelligence Provider (`Microsoft-Windows-Threat-Intelligence`) emits ProtectVirtualMemory and AllocVirtualMemory events for cross-process actions; correlating query-then-write is a strong injection heuristic.

Direct syscall examples

; Direct syscall stub for NtQueryVirtualMemory (SSN 0x23, all builds)
NtQueryVirtualMemory PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 23h          ; SSN
    syscall
    ret
NtQueryVirtualMemory ENDP

// Walk the host VA space and locate amsi.dll's image mapping using
// MemoryMappedFilenameInformation -> AmsiScanBuffer can then be patched.
#include <windows.h>

#define MemoryMappedFilenameInformation 2

typedef NTSTATUS (NTAPI *pNtQueryVirtualMemory)(
    HANDLE, PVOID, ULONG, PVOID, SIZE_T, PSIZE_T);

PVOID FindAmsi(void) {
    pNtQueryVirtualMemory NtQueryVirtualMemory =
        (pNtQueryVirtualMemory)GetProcAddress(
            GetModuleHandleA("ntdll.dll"), "NtQueryVirtualMemory");

    BYTE buf[1024];
    SIZE_T ret;
    for (ULONG_PTR addr = 0x10000; addr < 0x7FFFFFFFFFFF; addr += 0x10000) {
        if (NtQueryVirtualMemory((HANDLE)-1, (PVOID)addr,
                MemoryMappedFilenameInformation, buf, sizeof buf, &ret) == 0) {
            UNICODE_STRING *us = (UNICODE_STRING*)buf;
            if (wcsstr(us->Buffer, L"\\amsi.dll"))
                return (PVOID)addr;
        }
    }
    return NULL;
}

// Cargo: windows-sys = "0.59" (Win32_System_Memory, Win32_Foundation)
use windows_sys::Win32::System::Memory::*;
use windows_sys::Win32::Foundation::HANDLE;

// Find RWX regions in a remote process — implant validation, EDR audit, or victim recon.
pub unsafe fn find_rwx(proc_handle: HANDLE) -> Vec<usize> {
    let mut out = Vec::new();
    let mut addr: usize = 0;
    let mut mbi: MEMORY_BASIC_INFORMATION = core::mem::zeroed();
    while VirtualQueryEx(proc_handle, addr as _, &mut mbi,
                         core::mem::size_of_val(&mbi)) != 0 {
        if mbi.State == MEM_COMMIT && mbi.Protect == PAGE_EXECUTE_READWRITE {
            out.push(mbi.BaseAddress as usize);
        }
        addr = mbi.BaseAddress as usize + mbi.RegionSize;
    }
    out
}

MITRE ATT&CK mappings

• T1057Process Discoverymitre ↗
• T1622Debugger Evasionmitre ↗
• T1106Native APImitre ↗
• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗