ULONG SetProtect(HANDLE pid, PVOID addr, ULONG size, ULONG protect) {
typedef NTSTATUS(*pZwProtectVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, PULONG ProtectSize, ULONG NewProtect, PULONG OldProtect);
pZwProtectVirtualMemory ZwProtectVirtualMemory = (pZwProtectVirtualMemory)((UINT64)ZwWaitForSingleObject + 0x20 * (0x4d - 1));
// 根据pid获取PEPROCESS
PEPROCESS process;
PsLookupProcessByProcessId(pid, &process);
ULONG OldProtect = 0;
KAPC_STATE apc_state;
// 附加来切换到目标进程()
KeStackAttachProcess(process, &apc_state);
// 判断目标地址的数据是否有效()
ZwProtectVirtualMemory(NtCurrentProcess(), &addr, &size, protect, &OldProtect);
// 切换到原进程()
KeUnstackDetachProcess(&apc_state);
// 引用计数-1
ObDereferenceObject(process);
return OldProtect;
}
