VirtualQuery dumping manually mapped pages

[big_coder]

Hello. I'm trying to use VirtualQuery to scan for manually mapped / loaded without LoadLibrary DLL pages inside of a process. I'm scanning between the maximum and minimum application addresses from GetSystemInfo, and increment the current address passed into VirtualQuery each loop itteration by RegionSize from MEMORY_BASIC_INFORMATION; My question is, what checks should I put on MBI allocationbase, state, protect, type etc. in order to find manually mapped pages of the DLL in the process. In the end I want to be able to dump the pages of the .text, .rdata, .data, etc. segments from the process for further analysis.

Edited July 1, 2017 by big_coder