Question

Im reverse engineering a file and I came across this line of code

Call DWORD PTR DS:[3F1010]

and ollydbg's comment to this line is, Kernel32.VirtualProtect

The question is what does this function do? I already did my own research bout this function in msdn but I still can't understand it clearly. Does it also mean that the memory or the virtual page (whatever you call it) that it protects will not be readable in ollydbg?

Was it helpful?

Solution

VirtualProtect, changes the protection options (i.e. the way application is allowed to access the memory) of some memory region already allocated with VirtualAllocate or other memory functions. There are many protection options available - readonly, readwrite, execute, all of them etc. Check them in MSDN.

As a rule, when the memory is allocated, it has some of these protection options assigned. But if one wants to change them later - VirtualProtect is the function he need to use.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top