NtProtectVirtualMemory document

About ntdll!NtProtectVirtualMemory

Syntax

// C++
NTSYSAPI 
NTSTATUS
NTAPI

NtProtectVirtualMemory(
  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress,
  IN OUT PULONG           NumberOfBytesToProtect,
  IN ULONG                NewAccessProtection,
  OUT PULONG              OldAccessProtection 
);

Information

The 'Virtual Protect' API internals call API

Parameters

• Process Handle
  • process handle
• Base address
  • pointer of the base address
  • this parameter is volatile (overwrite by function)
• Number Of Bytes To Protect
  • pointer of the variable holds number of bytes to protect
• New access protection
  • new page access protection value
• Old access protection
  • old page access protection value

For example

NTSTATUS MyVirtualProtectEx(
    IN HANDLE               ProcessHandle,
    IN OUT PVOID            BaseAddress,
    IN OUT ULONG            NumberOfBytesToProtect,
    IN ULONG                NewAccessProtection,
    OUT PULONG              OldAccessProtection 
)
{
    LPVOID temp = BaseAddress;
    ULONG size = NumberOfBytesToProtect;

    return NtProtectVirtualMemory (
       ProcessHandle,
       &temp,
       &size,
       PAGE_EXECUTE_READWRITE,
       OldAccessProtection
    );
}