DllCall VirtualProtectEx error 87 and 988 Topic is solved

[Cuadrix]

I'm trying to change the protection of a page in memory using DllCall but I run into some troubles;
With the code snippet below, I get error 87 in A_LastError, which means I have an invalid paramater. I tried a couple combinations with no luck.
I need to store the old protection to lpflOldProtect, otherwise I will get the error 988 because as per the MSDN docs, that is the expected behavior.

Could someone skilled spot where I have missed?

Code: Select all

VarSetCapacity(lpflOldProtect, 4)
vStatus := DllCall("VirtualProtectEx", "Ptr", hProcess, "Ptr", Address, "Ptr", 4, "UInt", 0x04, "Ptr", &lpflOldProtect)

[swagfag]

Code: Select all

VarSetCapacity(lpflOldProtect, A_PtrSize)

?

[Helgef]

No. You can skip varsetcapacity and use "uint*" if you like though.
You call the function correctly as far as I can see, I don't think we can help you if you don't supply more information about what you pass.

[Helgef]

One example:

Code: Select all

flAllocationType := MEM_COMMIT := 0x00001000
flProtect := PAGE_NOACCESS := 0x01
dwSize := 4
if !lpAddress := VirtualAlloc(0, dwSize, flAllocationType, flProtect) ; Use VirtualFree to free this handle
	throw

hProcess := GetCurrentProcess()
flNewProtect := PAGE_READONLY := 0x02
lpflOldProtect := 0
VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, lpflOldProtect)
msgbox % "last error:`t" . a_lasterror . "`nold protect:`t" . lpflOldProtect

VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect) {
	/*
	LPVOID VirtualAlloc(
		LPVOID lpAddress,
		SIZE_T dwSize,
		DWORD  flAllocationType,
		DWORD  flProtect
	);
	*/
	return dllcall("Kernel32.dll\VirtualAlloc", "ptr", lpAddress, "ptr", dwSize, "uint", flAllocationType, "uint", flProtect, "ptr")
}
VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, byref lpflOldProtect) {
/*
BOOL VirtualProtectEx(
  HANDLE hProcess,
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD  flNewProtect,
  PDWORD lpflOldProtect
);
*/
	return dllcall("Kernel32.dll\VirtualProtectEx", "ptr", hProcess, "ptr", lpAddress, "ptr", dwSize, "uint", flNewProtect, "uint*", lpflOldProtect, "int")
}
GetCurrentProcess() {	
	/*
	HANDLE GetCurrentProcess()
	*/
	return dllcall("Kernel32\GetCurrentProcess", "ptr")
}

Cheers.

[Cuadrix]

Turns out the issue was the address I was passing to the function.

Basically I used classMemory by RHCP to get the address of a region with a string as a haystack. I passed in an array of bytes encoded as UTF-8 instead of UTF-16 which messed up the return result, thus leading VirtualProtectEx to fail.

Thanks for letting me know about UInt* though, @Helgef