Register for your free account! | Forgot your password?

Go Back   elitepvpers > Coders Den > AutoIt
You last visited: Today at 00:01

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



VirtualProtect

Discussion on VirtualProtect within the AutoIt forum part of the Coders Den category.

Closed Thread
 
Old   #1
 
HaMaDa..'s Avatar
 
elite*gold: 37
Join Date: May 2014
Posts: 1,835
Received Thanks: 9,833
VirtualProtect

Closed.
HaMaDa.. is offline  
Old 03/25/2017, 02:02   #2
 
elite*gold: 100
Join Date: Apr 2008
Posts: 860
Received Thanks: 1,487
VirtualProtect changes the access permissions to a memory region. While some areas are writeable without any change (e.g. data-structures), some are forbidden to write (executeable code!).
In case you want to change something in such region, you need to change the access permissions by using VirtualProtect, or the write access will fail on an access violation.
You can also allocate memory and define it as executable. I've seen autoit malware doing this for hiding problematic code. In other native languages, this is a common technique in runtime packers for unpacking the binary payload.

In general, cheats and gamehacks use PAGE_EXECUTE_READWRITE to simply gain all access rights when they need to change executable code.

See:

The same goes for OpenProcess. If you know what you want to do, you can choose lesser permissions, but in general, just take any permission you can get and you are good.
florian0 is offline  
Thanks
2 Users
Old 03/27/2017, 22:39   #3
dotCom
 
Devsome's Avatar
 
elite*gold: 9842
The Black Market: 107/0/0
Join Date: Mar 2009
Posts: 16,868
Received Thanks: 4,685
The Question was
Quote:
Hi everyone ...
Well it may be a stupid question about using virtualprotect
First i wanted to know why we use this function ? i searched on google about and found some functions includes virtualprotect but ... the function will also work without virtualprotect

Global Const $PAGE_EXECUTE = 0x10
Global Const $PAGE_EXECUTE_READ = 0x20
Global Const $PAGE_EXECUTE_READWRITE = 0x40
Global Const $PAGE_EXECUTE_WRITECOPY = 0x80
Global Const $PAGE_NOACCESS = 0x1
Global Const $PAGE_READONLY = 0x2
Global Const $PAGE_READWRITE = 0x4
Global Const $PAGE_WRITECOPY = 0x8
Global Const $MEM_COMMIT = 0x1000
Global Const $MEM_RESERVE = 0x2000
Global Const $MEM_RESET = 0x80000
Global Const $MEM_DECOMMIT = 0x4000
Global Const $MEM_RELEASE = 0x8000

Also what's 0x10 / 0x40 etc ...

Global Const $PROCESS_ALL_ACCESS = 0x1F0FFF

Also here in opening the process why we uses 0x1F0FFF ?
#closed then
Devsome is offline  
Thanks
2 Users
Closed Thread




All times are GMT +1. The time now is 00:01.


Powered by vBulletin®
Copyright ©2000 - 2026, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2026 elitepvpers All Rights Reserved.