I am working on an NT 5 (2128) machine and cannot seem to get VirtualProtectEx/WriteProcessMemory working correctly. I need to make some changes in ntdll.dll in a process that I have called CreateProcess(... SUSUPENDED...) on.
This is what I am doing:
MEMORY_BASIC_INFORMATION mbi_thunk ;
VirtualQueryEx ( ppi->hProcess,
sizeof ( MEMORY_BASIC_INFORMATION ) );
if ( !WriteProcessMemory( ppi->hProcess, (LPVOID)pvLoc,
(LPVOID)pvBuffer, sizeof(DWORD), &dwWritten ) )
printf("WriteProcessMemory failed: 0x%X\n", GetLastError() );
The WriteProcessMemory always fails with: 0x3E6 - "Invalid access to memory location."
Even though I didn't show it above, the VirtualQueryEx and VirtualProtectCalls both succeed.
Any clues as to what I am doint wrong here?