Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

VirtualProtectEx fails with ERROR_NOACCESS (error code 998)

Tags:

c

winapi

CreateProcess("something.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, 
    NULL, NULL, &sInfo, &pInfo);

ReadProcessMemory(pInfo.hProcess, (LPCVOID) (contx.Ebx + 8),
  (LPVOID) &baseAddress, sizeof(baseAddress), NULL);

hProcess=OpenProcess(PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_VM_OPERATION,
  FALSE, pInfo.dwProcessId);

VirtualProtectEx(hProcess, (LPVOID) baseAddress, sizeof(IMAGE_DOS_HEADER),
    PAGE_EXECUTE_READWRITE, NULL);

WriteProcessMemory(hProcess, (LPVOID) baseAddress, (LPCVOID) pidh,
    sizeof(IMAGE_DOS_HEADER), NULL);

Why VirtualProctecEx gives me ERROR_NOACCESS ?

like image 991
Hanan N. Avatar asked Oct 21 '25 02:10

Hanan N.


1 Answers

The VirtualProtectEx docs say

lpflOldProtect [out] A pointer to a variable that receives the previous access protection of the first page in the specified region of pages. If this parameter is NULL or does not point to a valid variable, the function fails.

about the last argument. You're passing NULL so should expect it to fail.

Its possible there are also other problems. e.g. you don't check the return value from ReadProcessMemory so baseAddress may be invalid.

like image 188
simonc Avatar answered Oct 23 '25 16:10

simonc



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!