Skip to content

Commit

Permalink
Test only the pages spanning VirtualProtect
Browse files Browse the repository at this point in the history
  • Loading branch information
Burnt-o authored Jan 24, 2025
1 parent 9eec2cb commit 50540b0
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions src/os.windows.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -259,21 +259,22 @@ void trap_threads(uint8_t* from, uint8_t* to, size_t len, const std::function<vo
MEMORY_BASIC_INFORMATION find_me_mbi{};
MEMORY_BASIC_INFORMATION from_mbi{};
MEMORY_BASIC_INFORMATION to_mbi{};
MEMORY_BASIC_INFORMATION virtual_protect_mbi{};

VirtualQuery(reinterpret_cast<void*>(find_me), &find_me_mbi, sizeof(find_me_mbi));
VirtualQuery(from, &from_mbi, sizeof(from_mbi));
VirtualQuery(to, &to_mbi, sizeof(to_mbi));
VirtualQuery(reinterpret_cast<void*>(VirtualProtect), &virtual_protect_mbi, sizeof(virtual_protect_mbi));

auto new_protect = PAGE_READWRITE;

if (from_mbi.AllocationBase == find_me_mbi.AllocationBase || to_mbi.AllocationBase == find_me_mbi.AllocationBase) {
new_protect = PAGE_EXECUTE_READWRITE;
}

if (from_mbi.BaseAddress == virtual_protect_mbi.BaseAddress ||
to_mbi.BaseAddress == virtual_protect_mbi.BaseAddress) {
auto si = system_info();

// Check if the target shares a memory page with VirtualProtect
if (reinterpret_cast<uint8_t*>(&VirtualProtect) <= align_up(from + len, si.page_size) &&
align_down(from, si.page_size) <= reinterpret_cast<uint8_t*>(&VirtualProtect) + 0x20) {
new_protect = PAGE_EXECUTE_READWRITE;
}

Expand Down

0 comments on commit 50540b0

Please sign in to comment.