Cheat Engine

iPromise

What are some methods to protect usermode memory in a driver without utilizing Nt/ZwProtectVirtualMemory?

Dark Byte · Posted: Tue Nov 06, 2012 4:20 pm Post subject:

another thing you could try is get the callnumber of NtProtectVirtualMemory from a usermode app. (the mov eax,xxxx part)
Then get the disassembly of a function you have access to (e.g ZwCreateFile and then rebuild that function somewhere else to make use of the callnumber of NtProtectVirtualMemory)

e.g: XP kernelmode ZwCreateFile=

iPromise · Posted: Tue Nov 06, 2012 9:55 pm Post subject:

My intention is to set a hook on a usermode address.

So you mean something like this within my driver assuming the call number is 0x89:

Dark Byte · Posted: Wed Nov 07, 2012 4:00 am Post subject:

Yes, and of course, replace the call with the correct address. (Alternatively, do an AOB scan from your driver looking for the function that is the one you need)

Also, be aware that this will change the WHOLE page (4096 bytes, and not just the one address you wish to watch)

iPromise · Posted: Wed Nov 07, 2012 7:40 am Post subject:

Alright final question.

I get the call number with my usermode application then I send it to my driver.

As for my driver, after it receives the call number a byte signature scan is done for the bytes above but what region do I scan? The drivers range is nearly endless arn't I correct?

In regular scanning we use VirtualQuery with MBI_BASIC_INFORMATION and we read the following regions but in driver scanning, do we still apply the same concept?

If so what do we use for VirtualQuery?