#ifndef _NTMMAPI_H
//
// Virtual memory
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Changes the protection on a region of virtual memory.
*
* @param ProcessHandle A handle to the process whose memory protection is to be changed.
* @param BaseAddress A pointer to the base address of the region of pages whose access protection attributes are to be changed.
* @param RegionSize A pointer to a variable that specifies the size of the region whose access protection attributes are to be changed.
* @param NewProtection The memory protection option. This parameter can be one of the memory protection constants.
* @param OldProtection A pointer to a variable that receives the previous access protection of the first page in the specified region of pages.
* @return NTSTATUS Successful or errant status.
*/
NTSYSCALLAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG NewProtection,
_Out_ PULONG OldProtection
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwProtectVirtualMemory(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG NewProtection,
_Out_ PULONG OldProtection
);
View code on GitHub
Handle to Process Object opened with PROCESS_VM_OPERATION
access.
Pointer to base address to protect. Protection will change on all page containing specified address. On output, BaseAddress
will point to page start address.
Pointer to size of region to protect. On output will be round to page size (4KB).
One or some of PAGE_...
attributes.
Receive previous protection.