NtAllocateVirtualMemory syscall parameter

Question

Hello

I Checked all of the possible values of AllocationType parameter on AllocateVirtualMemory syscall and found out it accepts values like 0x202000 and 0x203000 and therefore there should be another undocumented possible flag with value 0x200000. In WinNt.h it's defined as MEM_WRITE_WATCH.

I want to know what it does?

Thank you.

Answer 1

You could always look up the documentation on MSDN: http://msdn.microsoft.com/en-us/library/aa366573%28VS.85%29.aspx

Causes the system to track pages that are written to in the allocated region. If you specify this value, you must also specify MEM_RESERVE.