DllCall VirtualProtectEx error 87 and 988 Topic is solved

Get help with using AutoHotkey and its commands and hotkeys
User avatar
Cuadrix
Posts: 224
Joined: 07 May 2017, 08:26

DllCall VirtualProtectEx error 87 and 988

26 Mar 2020, 23:25

I'm trying to change the protection of a page in memory using DllCall but I run into some troubles;
With the code snippet below, I get error 87 in A_LastError, which means I have an invalid paramater. I tried a couple combinations with no luck.
I need to store the old protection to lpflOldProtect, otherwise I will get the error 988 because as per the MSDN docs, that is the expected behavior.

Could someone skilled spot where I have missed?

Code: Select all

VarSetCapacity(lpflOldProtect, 4)
vStatus := DllCall("VirtualProtectEx", "Ptr", hProcess, "Ptr", Address, "Ptr", 4, "UInt", 0x04, "Ptr", &lpflOldProtect)
----
swagfag
Posts: 4080
Joined: 11 Jan 2017, 17:59

Re: DllCall VirtualProtectEx error 87 and 988

27 Mar 2020, 05:09

Code: Select all

VarSetCapacity(lpflOldProtect, A_PtrSize)
?
Helgef
Posts: 4467
Joined: 17 Jul 2016, 01:02
Contact:

Re: DllCall VirtualProtectEx error 87 and 988  Topic is solved

27 Mar 2020, 05:44

No. You can skip varsetcapacity and use "uint*" if you like though.
You call the function correctly as far as I can see, I don't think we can help you if you don't supply more information about what you pass.
Helgef
Posts: 4467
Joined: 17 Jul 2016, 01:02
Contact:

Re: DllCall VirtualProtectEx error 87 and 988

27 Mar 2020, 09:25

One example:

Code: Select all

flAllocationType := MEM_COMMIT := 0x00001000
flProtect := PAGE_NOACCESS := 0x01
dwSize := 4
if !lpAddress := VirtualAlloc(0, dwSize, flAllocationType, flProtect) ; Use VirtualFree to free this handle
	throw

hProcess := GetCurrentProcess()
flNewProtect := PAGE_READONLY := 0x02
lpflOldProtect := 0
VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, lpflOldProtect)
msgbox % "last error:`t" . a_lasterror . "`nold protect:`t" . lpflOldProtect

VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect) {
	/*
	LPVOID VirtualAlloc(
		LPVOID lpAddress,
		SIZE_T dwSize,
		DWORD  flAllocationType,
		DWORD  flProtect
	);
	*/
	return dllcall("Kernel32.dll\VirtualAlloc", "ptr", lpAddress, "ptr", dwSize, "uint", flAllocationType, "uint", flProtect, "ptr")
}
VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, byref lpflOldProtect) {
/*
BOOL VirtualProtectEx(
  HANDLE hProcess,
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD  flNewProtect,
  PDWORD lpflOldProtect
);
*/
	return dllcall("Kernel32.dll\VirtualProtectEx", "ptr", hProcess, "ptr", lpAddress, "ptr", dwSize, "uint", flNewProtect, "uint*", lpflOldProtect, "int")
}
GetCurrentProcess() {	
	/*
	HANDLE GetCurrentProcess()
	*/
	return dllcall("Kernel32\GetCurrentProcess", "ptr")
}
Cheers.
User avatar
Cuadrix
Posts: 224
Joined: 07 May 2017, 08:26

Re: DllCall VirtualProtectEx error 87 and 988

27 Mar 2020, 13:39

Turns out the issue was the address I was passing to the function.

Basically I used classMemory by RHCP to get the address of a region with a string as a haystack. I passed in an array of bytes encoded as UTF-8 instead of UTF-16 which messed up the return result, thus leading VirtualProtectEx to fail.

Thanks for letting me know about UInt* though, @Helgef
----

Return to “Ask For Help”

Who is online

Users browsing this forum: boiler, Google [Bot], JAutohotkey, mikeyww and 37 guests