ULONG KernelVirtualProtect(HANDLE pid, PVOID addr, ULONG size, ULONG protect)
{
ULONG OldProtect = -15942;
PEPROCESS process;
NTSTATUS status;
SIZE_T alloc_pagesize = 8;
KAPC_STATE apc_state;
PsLookupProcessByProcessId(pid, &process);
KeStackAttachProcess(process, &apc_state);
status =pfn_ZwProtectVirtualMemory(ZwCurrentProcess(),&addr, &alloc_pagesize,PAGE_EXECUTE_READWRITE,&OldProtect);
if (!NT_SUCCESS(status))
{return status;}
KeUnstackDetachProcess(&apc_state);
ObDereferenceObject(process);
return OldProtect;
}
hzqst
