Вопрос

Im reverse engineering a file and I came across this line of code

Call DWORD PTR DS:[3F1010]

and ollydbg's comment to this line is, Kernel32.VirtualProtect

The question is what does this function do? I already did my own research bout this function in msdn but I still can't understand it clearly. Does it also mean that the memory or the virtual page (whatever you call it) that it protects will not be readable in ollydbg?

Это было полезно?

Решение

VirtualProtect, changes the protection options (i.e. the way application is allowed to access the memory) of some memory region already allocated with VirtualAllocate or other memory functions. There are many protection options available - readonly, readwrite, execute, all of them etc. Check them in MSDN.

As a rule, when the memory is allocated, it has some of these protection options assigned. But if one wants to change them later - VirtualProtect is the function he need to use.

Лицензировано под: CC-BY-SA с атрибуция
Не связан с StackOverflow
scroll top