Viewing memory permissions in Ollydbg for memory segments

Question

I'm looking for a way to view memory permissions on a specific section of memory using OllyDbg (technically I'm using Immunity but I'm assuming if it exists in Olly it'll be the same there).

The program I'm looking at is calling VirtualProtect to make a block of code go RW->RWE, but the result looks like the protection is extending to 4 bytes before the address passed in as a parameter. I checked the MSDN and it said that there is a rounding/boundary extension with t VirtualProtect with respect to the size, but it doesn't say specifically how the extensions get propagated across pages.

I'm confident that's what's happening but I wanted to look at the memory permissions for the specific segment to confirm. It doesn't look like the Memory map refreshes after the call to VP and I couldn't find another place to show the memory permissions. On WinDbg I can do something like !vprot so I was curious if there was something similar here.

Answer 1

ollydbg 1.10 automatically refreshes the memory window when protection attributes are changed if the address that is passed on to VirtualProtect lies in the first allocated page

if subsequent page's attributes were changed using Virtualprotect ollydbg's memory window wont reflect them as it shows the complete allocated Size as one contiguous dump

windbg !vprot will show the modified protection attributes only if you traverse page by page

in ollydbg 2.01 memory window will show attribute changes page by page automatically

an example

int _tmain(int argc, _TCHAR* argv[])
{
    printf("lets valloc \n");
    PCHAR foo;
    foo = (PCHAR)VirtualAlloc(0,0x1004,MEM_COMMIT,PAGE_READONLY);
    printf("we valloced lets vprot\n");
    DWORD oldprot;
    if (  (VirtualProtect(foo+0x1000,1,PAGE_EXECUTE_READWRITE,&oldprot) == FALSE) )
    {
        printf("our vprot failed\n");
        return FALSE;
    }
    if (  (VirtualProtect(foo+0xfff,1,PAGE_EXECUTE_READWRITE,&oldprot) == FALSE) )
    {
        printf("our vprot failed\n");
        return FALSE;
    }
    printf("we vprotted fine \n");
    return 0;
}

ollydbg 1.10 memory window Display will be same after VirtualAlloc and after first Virtualprotect

display will change only after second VirtualProtect

Memory map, item 19
 Address=003A0000
 Size=00002000 (8192.)
 Owner=         003A0000 (itself)
 Section=
 Type=Priv 00021002
 Access=R
 Initial access=R

after second Virtualprotect

Memory map, item 19
 Address=003A0000
 Size=00002000 (8192.)
 Owner=         003A0000 (itself)
 Section=
 Type=Priv 00021040
 **Access=RWE**
 Initial access=R

windbg will show changed attribute only if traversed page by page

0:000> g
ModLoad: 5cb70000 5cb96000   C:\WINDOWS\system32\ShimEng.dll
Breakpoint 0 hit
>    8: {
0:000> p
>    9:     printf("lets valloc \n");
0:000> p
>   11:     foo = (PCHAR)VirtualAlloc(0,0x1004,MEM_COMMIT,PAGE_READONLY);
0:000> p
>   12:     printf("we valloced lets vprot\n");
0:000> ?? foo
char * 0x003a0000
 ""
0:000> !vprot @@c++(foo)
BaseAddress:       003a0000
AllocationBase:    003a0000
AllocationProtect: 00000002  PAGE_READONLY
RegionSize:        00002000
State:             00001000  MEM_COMMIT
Protect:           00000002  PAGE_READONLY
Type:              00020000  MEM_PRIVATE
0:000> p
>   14:     if (  (VirtualProtect(foo+0x1000,1,PAGE_EXECUTE_READWRITE,&oldprot) == FALSE) )
0:000> p
>   19:     if (  (VirtualProtect(foo+0xfff,1,PAGE_EXECUTE_READWRITE,&oldprot) == FALSE) )
0:000> !vprot @@c++(foo)
BaseAddress:       003a0000
AllocationBase:    003a0000
AllocationProtect: 00000002  PAGE_READONLY
RegionSize:        00001000
State:             00001000  MEM_COMMIT
Protect:           00000002  PAGE_READONLY
Type:              00020000  MEM_PRIVATE

0:000> !vprot (@@c++(foo)+1000)
BaseAddress:       003a1000
AllocationBase:    003a0000
AllocationProtect: 00000002  PAGE_READONLY
RegionSize:        00001000
State:             00001000  MEM_COMMIT
Protect:           00000040  PAGE_EXECUTE_READWRITE
Type:              00020000  MEM_PRIVATE

ollydbg 2.01 will show any changes instantly note memory map item no and address

Memory map, item 19
  Address = 003A0000
  Size = 00002000 (8192.)
  Owner =                 003A0000 (self)
  Section =
  Contains =
  Type = Priv 00021002
  Access = R
  Initial access = R
  Mapped as =

after first Virtualprotect

Memory map, item 20
  Address = 003A1000
  Size = 00001000 (4096.)
  Owner =                 003A0000
  Section =
  Contains =
  Type = Priv 00021040
  Access = RWE
  Initial access = R
  Mapped as =

Answer 2

I don't think there's another way to do it in Olly (barring plugins) but you can refresh the map using "Actualize" in the context menu.

You can also use another program like VMMap, or possibly even WinDbg in non-intrusive mode.

The permissions only apply to whole pages, so any address you pass will be rounded down and the size will be rounded up to a page boundary (1000 hex).