// 进程_修改内存属性(目标进程ID, 目标进程的地址, 内存大小, 内存
ULONG process_MemProtect(ULONG64 pid, PVOID addr, ULONG size, ULONG protect) {

typedef NTSTATUS(*pZwProtectVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG ProtectSize, ULONG NewProtect, PULONG OldProtect);
pZwProtectVirtualMemory ZwProtectVirtualMemory = (pZwProtectVirtualMemory)((UINT64)ZwWaitForSingleObject + 0x20 * (0x4d - 1));


//    根据pid获取PEPROCESS
PEPROCESS process = NULL;
PsLookupProcessByProcessId((HANDLE)pid, &process);

ULONG OldProtect = 0;
KAPC_STATE apc_state;
memset(&apc_state, 0, sizeof(apc_state));
//    附加来切换到目标进程()
KeStackAttachProcess(process, &apc_state);
//    判断目标地址的数据是否有效()
if (MmIsAddressValid(addr) == TRUE) {
    NTSTATUS status = ZwProtectVirtualMemory((HANDLE)-1, &addr, &size, protect, &OldProtect);
    if (!NT_SUCCESS(status)) {
        KdPrint(("status = %08X\n", status));
        return 0;
    }
}
//    切换到原进程()
KeUnstackDetachProcess(&apc_state);
//    引用计数-1
ObDereferenceObject(process);
return OldProtect;

}

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界