NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call
you can verify your pintool trace with this windbg conditional breakpoint on any executable that allocates memory
0:000> bl
0 e 7c809af1 0001 (0001) 0:**** kernel32!VirtualAlloc "bp /1 @$ra \"g\";wt"
0:000> $$ break on valloc set a one time condtional break on return address on the stack (condition == keep executing as is) and trace the call
0:000> g
result
Tracing kernel32!VirtualAlloc to return address 76fdc3ac
9 0 [ 0] kernel32!VirtualAlloc
3 0 [ 1] kernel32!VirtualAllocEx
19 0 [ 2] kernel32!_SEH_prolog
16 19 [ 1] kernel32!VirtualAllocEx
1 0 [ 2] ntdll!ZwAllocateVirtualMemory
2 0 [ 2] ntdll!NtAllocateVirtualMemory
2 0 [ 3] ntdll!KiFastSystemCall
1 0 [ 2] ntdll!NtAllocateVirtualMemory
22 25 [ 1] kernel32!VirtualAllocEx
9 0 [ 2] kernel32!_SEH_epilog
23 34 [ 1] kernel32!VirtualAllocEx
11 57 [ 0] kernel32!VirtualAlloc
68 instructions were executed in 67 events (0 from other threads)
Function Name Invocations MinInst MaxInst AvgInst
kernel32!VirtualAlloc 1 11 11 11
kernel32!VirtualAllocEx 1 23 23 23
kernel32!_SEH_epilog 1 9 9 9
kernel32!_SEH_prolog 1 19 19 19
ntdll!KiFastSystemCall 1 2 2 2
ntdll!NtAllocateVirtualMemory 2 1 2 1
ntdll!ZwAllocateVirtualMemory 1 1 1 1
1 system call was executed
Calls System Call
1 ntdll!KiFastSystemCall
edit
a trace result for VirtualProtect with call stack and raw Dword dump of esp
0:001> bl
0 e 7c801ad4 0001 (0001) 0:**** kernel32!VirtualProtect "dd esp l8;kb 3;bp /1 @$ra \"g\";wt"
dd esp l8
009df560 03042c08 00b10000 00002ab0 00000002
009df570 009df588 00000440 00832758 009df54c
kb 3
ChildEBP RetAddr Args to Child
009df55c 03042c08 00b10000 00002ab0 00000002 kernel32!VirtualProtect
009df58c 030420f7 008124b0 0084a610 00832758 dbghelp!idd2me+0x3d8
009dfa3c 03041c5a 00000440 00832758 00832758 dbghelp!modload+0x367
wt
Tracing kernel32!VirtualProtect to return address 03042c08
9 0 [ 0] kernel32!VirtualProtect
14 0 [ 1] kernel32!VirtualProtectEx
1 0 [ 2] ntdll!ZwProtectVirtualMemory
2 0 [ 2] ntdll!NtProtectVirtualMemory
2 0 [ 3] ntdll!KiFastSystemCall
1 0 [ 2] ntdll!NtProtectVirtualMemory
23 6 [ 1] kernel32!VirtualProtectEx
11 29 [ 0] kernel32!VirtualProtect
40 instructions were executed in 39 events (0 from other threads)
Function Name Invocations MinInst MaxInst AvgInst
kernel32!VirtualProtect 1 11 11 11
kernel32!VirtualProtectEx 1 23 23 23
ntdll!KiFastSystemCall 1 2 2 2
ntdll!NtProtectVirtualMemory 2 1 2 1
ntdll!ZwProtectVirtualMemory 1 1 1 1
1 system call was executed
Calls System Call
1 ntdll!KiFastSystemCall
VirtualAlloc
for a specific process, inject your DLL inside, hookVirtualAlloc
( which looks like this ; you can useGetProcAddress(kernel32_handle, "VirtualAlloc")
for the offset at runtime ) and intercept. If you want to do it system-wide, you can do it using a driver... or injecting your DLL into every process. Do tell me if you need help doing it for a single process.ZwResumeThread
is0x4F
(ntdll.dll
, x64). It is probably different on your system. While it is possible for the IDs to be the same, you shouldn't rely on that if you want portability. I'm not sure about ring0, though.