Topic created on: May 15, 2008 20:42 CDT by FILEOBJECT .

I posted on another thread in regards to retrieving memory maps within the kernel.  Someone provided an article that described the process which essentially located the VadRoot MMVAD structure in the processes EPROCESS structure and walked the binary tree to enumerate all available ranges.  However, this method is not portable between NT builds, as the exported _MMVAD and EPROCESS change between builds.  

for example on build xp build 2600 MMVAD looks like this
kd> dt nt!_MMVAD
   +0x000 StartingVpn      : Uint4B
   +0x004 EndingVpn        : Uint4B
   +0x008 Parent           : Ptr32 _MMVAD
   +0x00c LeftChild        : Ptr32 _MMVAD
   +0x010 RightChild       : Ptr32 _MMVAD
   +0x014 u                : __unnamed
   +0x018 ControlArea      : Ptr32 _CONTROL_AREA
   +0x01c FirstPrototypePte : Ptr32 _MMPTE
   +0x020 LastContiguousPte : Ptr32 _MMPTE
   +0x024 u2               : __unnamed

and on vista you have this:
http://www.nirsoft.net/kernel_struct/vista/MMVAD.html

Is there a way to get the same information, in a build portable manner?

Thanks.