1

Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?

1

You can do it in IDA by calling VirtualProtect in the process' context with Appcall. From Practical Appcall examples:

In the following example we will change the PE header page protection to execute/read/write (normally it is read-only):

virtprot = Appcall.proto("kernel32_VirtualProtect",
  "BOOL __stdcall VirtualProtect(LPVOID addr, DWORD sz, DWORD newprot, PDWORD oldprot);")
r = virtprot(0x400000, 0x1000, Appcall.Consts.PAGE_EXECUTE_READWRITE, Appcall.byref(0));
print "VirtualProtect returned:", r
RefreshDebuggerMemory()

Possibly other debuggers can do something similar (e.g. WinDbg has .call)

0

From the x64dbg Memory Map tab you can right click a mapped section and select Set Page Memory Rights from the context menu.

Section Memory Context Menu

From there, you can control the access for each page in that section.

Page Permissions

Igor's answer offers a lot of flexibility though, and Im not sure if x64dbg provides an API for this in their plugin/scripting interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.