Identifying memory-mapped files

Question

I'm identifying parts of process's virtual memory using VirtualQuery. I identify regions taken by mapped files (MEM_MAPPED), but how to determine actual files (filenames) of files allocated there? I suppose it has something to do with MapView* family of APIs but cant figure it out exactly...

Answer 1

It looks like GetMappedFileName() is the function you want.

DWORD WINAPI GetMappedFileName(
    __in   HANDLE hProcess,
    __in   LPVOID lpv,
    __out  LPTSTR lpFilename,
    __in   DWORD nSize
);

GetMappedFileName on MSDN