param( [Parameter(Mandatory = $true)] [int]$ProcessId, [int64]$MinimumSize = 0x1000000 ) $source = @' using System; using System.Collections.Generic; using System.ComponentModel; using System.Runtime.InteropServices; public static class ProcessMemoryRegions { [StructLayout(LayoutKind.Sequential)] public struct Region { public IntPtr BaseAddress; public IntPtr AllocationBase; public uint AllocationProtect; public ushort PartitionId; public UIntPtr RegionSize; public uint State; public uint Protect; public uint Type; } [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr OpenProcess(uint access, bool inherit, int processId); [DllImport("kernel32.dll", SetLastError = true)] private static extern bool CloseHandle(IntPtr handle); [DllImport("kernel32.dll", SetLastError = true)] private static extern UIntPtr VirtualQueryEx(IntPtr process, IntPtr address, out Region information, UIntPtr length); public static Region[] List(int processId, long minimumSize) { IntPtr process = OpenProcess(0x0400, false, processId); if (process == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error(), "OpenProcess failed"); var result = new List(); try { ulong address = 0x10000; const ulong maximum = 0x00007fffffff0000UL; int size = Marshal.SizeOf(); while (address < maximum) { Region region; if (VirtualQueryEx(process, new IntPtr(unchecked((long)address)), out region, new UIntPtr((uint)size)) == UIntPtr.Zero) break; ulong baseAddress = unchecked((ulong)region.BaseAddress.ToInt64()); ulong regionSize = region.RegionSize.ToUInt64(); if (regionSize == 0) break; if (region.State == 0x1000 && regionSize >= (ulong)minimumSize) result.Add(region); address = baseAddress + regionSize; if (address <= baseAddress) break; } } finally { CloseHandle(process); } return result.ToArray(); } } '@ Add-Type -TypeDefinition $source -Language CSharp [ProcessMemoryRegions]::List($ProcessId, $MinimumSize) | ForEach-Object { [pscustomobject]@{ Base = '0x{0:x16}' -f [uint64]$_.BaseAddress.ToInt64() AllocationBase = '0x{0:x16}' -f [uint64]$_.AllocationBase.ToInt64() Size = '0x{0:x}' -f $_.RegionSize.ToUInt64() Protect = '0x{0:x}' -f $_.Protect Type = '0x{0:x}' -f $_.Type } }