1

VirtualProtect is straightforward but I get some results that I can't explain. Something's going on in the background probably but I'd like to know what.

The following is under Windows 7 SP1 Ultimate x64, using a DLL compiled for Windows 10 by VS 2015. The DLL modifies some other DLL in memory. The result DLL was working fine under Win 7 but it was crashing under Win 10 (no dump produced). So I started following the code in case it was something obvious.

The code that looked strange, is the following (in pseudocode):

if (VirtualProtect(BaseAddr, BaseSize, PAGE_EXECUTE_READWRITE, &dwProtect) == 0)
        {
            GetLastError());
            goto _exit;
        }

At this point, the new protection should be 0x40 (PAGE_EXECUTE_READWRITE). The current protection that comes back in dwProtect is 0x2 (PAGE_READONLY).

...some more code here that writes data in the modified memory block...

_exit:
if (VirtualProtect(BaseAddr, BaseSize, PAGE_EXECUTE_READWRITE, &dwProtect) == 0)
            {
                GetLastError());
            }

At this point, the dwProtect gets the value 0x80 !! Why? Shouldn't it be 0x40 ?

If on the second call I try to restore the original value (0x2) by passing the saved dwProtect, it still doesn't return 0x40. (I think it returned 0x4). I even tried setting it to 0x80 on the first call. It came back the same (0x80). It didn't double it but the DLL would crash.

The question is, why on the second call, it doesn't return back the value I set it to on the first call.

Thanks in advance for any clarification.

1

This seems to be working as intended.

Flag 0x80 is PAGE_EXECUTE_WRITECOPY. You can look it up in msdn.

If a memory page with the "PAGE_EXECUTE_READWRITE" access protection attributes is requested from the OS, then a page with the "PAGE_EXECUTE_WRITECOPY" attributes, not the "PAGE_EXECUTE_READWRITE" attributes is given.

The reason for that behavior is so simple, that is, the OS memory manager wants to physically share the page between all the process instances (since it is guaranteed to be the same in all the process instances before any write).

Find the full source here, copyright to Walied Assar

  • Thank you much. Good to know. I had started doubting what I was seeing :) – kanenas Sep 8 '16 at 19:06
  • No problem ;) Accept it, if you like it – Nordwald Sep 8 '16 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.