in functions/kernel32.py [0:0]
def VirtualProtect(self, is_return=False):
if is_return:
return f"{hex(funcutils.get_result(self.is_64bit))} -> BOOL"
lpAddress = funcutils.get_func_args(1, self.is_64bit)
dwSize = funcutils.get_func_args(2, self.is_64bit)
flNewProtect = funcutils.get_func_args(3, self.is_64bit)
lpflOldProtect = funcutils.get_func_args(4, self.is_64bit)
protection_flags = []
if flNewProtect & 0x01:
protection_flags.append("PAGE_NOACCESS")
if flNewProtect & 0x02:
protection_flags.append("PAGE_READONLY")
if flNewProtect & 0x04:
protection_flags.append("PAGE_READWRITE")
if flNewProtect & 0x08:
protection_flags.append("PAGE_WRITECOPY")
if flNewProtect & 0x10:
protection_flags.append("PAGE_EXECUTE")
if flNewProtect & 0x20:
protection_flags.append("PAGE_EXECUTE_READ")
if flNewProtect & 0x40:
protection_flags.append("PAGE_EXECUTE_READWRITE")
if flNewProtect & 0x80:
protection_flags.append("PAGE_EXECUTE_WRITECOPY")
if flNewProtect & 0x100:
protection_flags.append("PAGE_GUARD")
if flNewProtect & 0x200:
protection_flags.append("PAGE_NOCACHE")
if flNewProtect & 0x400:
protection_flags.append("PAGE_WRITECOMBINE")
protection_flags_str = '|'.join(protection_flags) if protection_flags else 'UNKNOWN'
_debug_info = (f"lpAddress={hex(lpAddress)}, "
f"dwSize={dwSize}, "
f"flNewProtect={protection_flags_str}, "
f"lpflOldProtect={hex(lpflOldProtect)}) = ")
return _debug_info