Cheat Engine

iPromise · Posted: Sat Nov 03, 2012 3:26 pm Post subject: NtProtectVirtualMemory

How come MSDN has no documentation on this function?

Its also not defined in the ntdll so I how do I access it with my driver?

Any ideas? If its not defined, and I need to obtain its address what function can I use?

Thanks a bunch

Dark Byte · Posted: Sat Nov 03, 2012 5:18 pm Post subject:

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Memory%20Management/Virtual%20Memory/NtProtectVirtualMemory.html

Use MmGetSystemRoutineAddress to get the address of that function

Also, it is exported in ntdll so you can even use it in usermode

iPromise · Posted: Sat Nov 03, 2012 8:38 pm Post subject:

Dark Byte · Posted: Sun Nov 04, 2012 3:22 am Post subject:

Try the Zw version

iPromise · Posted: Sun Nov 04, 2012 11:21 am Post subject:

Dark Byte · Posted: Sun Nov 04, 2012 1:12 pm Post subject:

ZwReadVirtualMemory is defined in the exports of the kernel and in it's .lib, so if you just define it as a export to be loaded it should just work
Not sure why The MmGetSystemRoutineAddress fails though

iPromise · Posted: Sun Nov 04, 2012 4:01 pm Post subject:

MmGetSystemRoutineAddress works for any other address like itself and other addresses supported by the DDK I think. How can i grab the kernal address of NtProtectVirtualMemory without using MmGetSystemRoutineAddress?