From: André Hentschel Subject: ntdll: Allow reading from a VPROT_WRITECOPY protected memory (try 2) Message-Id: <4E6643AA.8070606@dawncrow.de> Date: Tue, 06 Sep 2011 18:00:42 +0200 --- dlls/ntdll/virtual.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index a7679da..dda1f37 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -1341,7 +1341,7 @@ static NTSTATUS map_image( HANDLE hmapping, int fd, char *base, SIZE_T total_siz size = ROUND_SIZE( sec->VirtualAddress, sec->SizeOfRawData ); if (sec->Characteristics & IMAGE_SCN_MEM_READ) vprot |= VPROT_READ; - if (sec->Characteristics & IMAGE_SCN_MEM_WRITE) vprot |= VPROT_WRITECOPY; + if (sec->Characteristics & IMAGE_SCN_MEM_WRITE) vprot |= VPROT_READ | VPROT_WRITECOPY; if (sec->Characteristics & IMAGE_SCN_MEM_EXECUTE) vprot |= VPROT_EXEC; /* Dumb game crack lets the AOEP point into a data section. Adjust. */ -- Best Regards, André Hentschel