Does VirtualProtect need some privileges - winapi

Question

I am trying to implement an IAT hook. I wrote the IAT part in a dll, and the injection part in an exe with CreateRemoteThread. I found after I injected the dll, the VirtualProtect function in IAT part always threw an ERROR_INVALID_PRAMETER, even I passed the paramters with values just returned from VirtualQuery. I have no idea that what have happened. Does the VirtualProtect need some privileges that I do not have?
Here is the error part:
if (0 == lstrcmpA(lpApiName, (LPCSTR)pImport->Name)){
MEMORY_BASIC_INFORMATION thunkMemInfo;
DWORD junk;
DWORD oldProtect;
if (!VirtualQuery(thunk, &thunkMemInfo, sizeof(MEMORY_BASIC_INFORMATION))){
return GetLastError();
}
if (!VirtualProtect(thunkMemInfo.BaseAddress, thunkMemInfo.RegionSize, thunkMemInfo.Protect, &oldProtect)){
return GetLastError(); -------Here returns 87 in decimal
}
MessageBoxA(NULL, "aaaa", "Hooked", MB_OK);
thunk->u1.Function = (DWORD)Callback;
MessageBoxA(NULL, "bbbbb", "Hooked", MB_OK);
if (!VirtualProtect(&thunk, thunkMemInfo.RegionSize, oldProtect, &junk)){
return 3;
}
return S_OK;
}
And my injection part in C# is like this:
public static void InjectDLL(IntPtr hProcess, String strDLLName, Process proc)
{
IntPtr bytesout;
// Length of string containing the DLL file name +1 byte padding
Int32 LenWrite = strDLLName.Length + 1;
// Allocate memory within the virtual address space of the target process
IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory
// Write DLL file name to allocated memory in target process
WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
// Function pointer "Injector"
UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (Injector == null)
{
Console.WriteLine(" Injector Error! \n ");
// return failed
return;
}
// Create thread in target process, and store handle in hThread
IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
// Make sure thread handle is valid
if (hThread == null)
{
//incorrect thread handle ... return failed
Console.WriteLine(" hThread [ 1 ] Error! \n ");
return;
}
// Time-out is 10 seconds...
int Result = WaitForSingleObject(hThread, 10 * 1000);
// Check whether thread timed out...
if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFFL)
{
/* Thread timed out... */
Console.WriteLine(" hThread [ 2 ] Error! \n ");
// Make sure thread handle is valid before closing... prevents crashes.
if (hThread != null)
{
//Close thread in target process
CloseHandle(hThread);
}
return;
}
// Sleep thread for 1 second
Thread.Sleep(1000);
// Clear up allocated space ( Allocmem )
VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
// Make sure thread handle is valid before closing... prevents crashes.
if (hThread != null)
{
//Close thread in target process
CloseHandle(hThread);
}
// return succeeded
ResumeThread(hThread);
System.Windows.MessageBox.Show("Inject!");
return;
}
Process proc = Process.GetProcessesByName(exeName)[0];
// System.Windows.MessageBox.Show(proc.ProcessName + "Start!");
uint dwAccl = 0x0002 | 0x0400 | 0x0008 | 0x0010 |0x0020;
InjectDLL((IntPtr)tools.OpenProcess(dwAccl, 1, proc.Id), "Loader.dll", proc);

Answer 1

VirtualProtect(thunkMemInfo.BaseAddress, thunkMemInfo.RegionSize, thunkMemInfo.Protect, &oldProtect
The third argument:
thunkMemInfo.Protect
This is not a new memory protection constant, this is the one that you retrieved with VirtualQuery, all your doing is applying the same protection.
Change it to PAGE_EXECUTE_READWRITE (0x40) instead