Cheat Engine

[JosexD]

Hi !
how are you?

I've tried calling Nt and Zw ProtectVirtualMemory from a kernel mode driver to change the protection of a page of a user mode application

I've got the Nt version by KeServiceDescriptorTable.ServiceTableBase[0x89] and the Zw version by searching for the instruction mov eax, 0x00000089; I've tried using parameters defined at driver source code and also tried mapping mdl's as userland memory; though my page protection won't change
(I don't get any blue screen but my page protection doesn't change anyway)


I've only been able to change the protection of a page by hooking the std, that way I can use it fine and set the parameters I want and then protect any page; though I wanted to "call" XxProtectVirtualMemory without any hook so later I could make a trampoline

Thanks for your time reading

[JosexD]

finally problems solved
I was using ZwOpenProcess incorrectly so I wasn't getting the proper process handle

both methods (mdl mapping into usermode memory, and using ZwAllocateVirtualMemory to allocate near zero) worked fine for NtProtectVirtualMemory and also for ZwProtectVirtualMemory

I'll try to clean the code a bit xD