changeofpace / force-page-protection Goto Github PK

Hello. First let me say thank you for this plugin! When I try and use it on a sample that behaves very similar to your sample, I get the error "Not a valid memory region".

This sample does the following:

CreateSection() with these argument values:

• DesiredAccess = SECTION_ALL_ACCESS (0xF001F)
• SectionPageProtection = PAGE_EXECUTE_READWRITE
• AllocationAttributes = SEC_COMMIT|SEC_NO_CHANGE (0x08400000)

MapViewOfFileEx() with these argument values:

• hFileMappingObject = result of CreateSection()
• dwDesiredAccess = SECTION_ALL_ACCESS (0xF001F)

VirtualProtect() with these argument values:

• lpAddress = base address of module
• dwSize = SizeOfImage from PE header
• flNewProtect = PAGE_EXECUTE_READWRITE (0x40)

At this point, x64dbg seems to forget about only the .text segment of the original module. That is, it disappears from the memory map, relative address syntax (e.g. :0 + 0xF000) fails, and if I try to navigate the CPU disassembly window to an instruction in the .text segment , it reports "Invalid memory address". Figuring that perhaps the fpp command was to establish rules for future enforcement, I have tried running it on an EA from the .text segment of the module both before and after the VirtualProtect() call. In the before case, the command seems to work, but does not prevent the .text segment from disappearing.

I'm not sure it's relevant, but after this the sample I'm working with will also:

• Copy the entire module into the address returned by MapViewOfFile()
• Call UnmapViewOfFile() on the original module location. This causes the entire module to disappear from the Memory Map window in x64dbg, whereas before it was only the .text segment.

I'm not sure if this is a bug, I am somehow using it wrong, or if something about this sample is unsupported. I would appreciate any guidance you can give. I can certainly give you any additional information that you might need.

Thank you for your time.