質問

Im reverse engineering a file and I came across this line of code

Call DWORD PTR DS:[3F1010]

and ollydbg's comment to this line is, Kernel32.VirtualProtect

The question is what does this function do? I already did my own research bout this function in msdn but I still can't understand it clearly. Does it also mean that the memory or the virtual page (whatever you call it) that it protects will not be readable in ollydbg?

役に立ちましたか?

解決

VirtualProtect, changes the protection options (i.e. the way application is allowed to access the memory) of some memory region already allocated with VirtualAllocate or other memory functions. There are many protection options available - readonly, readwrite, execute, all of them etc. Check them in MSDN.

As a rule, when the memory is allocated, it has some of these protection options assigned. But if one wants to change them later - VirtualProtect is the function he need to use.

ライセンス: CC-BY-SA帰属
所属していません StackOverflow
scroll top