[PATCH 1/1] kernelbase: Allow WriteProcessMemory to succeed on PAGE_EXECUTE_READ.

[Marc-Aurel Zent]

From: Marc-Aurel Zent

---
 dlls/kernel32/tests/virtual.c |  7 ++++++
 dlls/kernelbase/memory.c      | 40 ++++++++++++++++++++++++++++++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/dlls/kernel32/tests/virtual.c b/dlls/kernel32/tests/virtual.c
index a023104ad88..7a23962be54 100644
--- a/dlls/kernel32/tests/virtual.c
+++ b/dlls/kernel32/tests/virtual.c
@@ -122,6 +122,13 @@ static void test_VirtualAllocEx(void)
     b = ReadProcessMemory(hProcess, addr1, src, 0, &bytes_read);
     ok(b && !bytes_read, "read failed: %lu\n", GetLastError());

+    /* test write to read-only execute region */
+    addr2 = VirtualAllocEx(hProcess, NULL, alloc_size, MEM_COMMIT,
+                           PAGE_EXECUTE_READ);
+    ok(addr2 != NULL, "VirtualAllocEx error %lu\n", GetLastError());
+    b = WriteProcessMemory(hProcess, addr2, src, alloc_size, &bytes_written);
+    ok(b, "WriteProcessMemory should succeed on a PAGE_EXECUTE_READ region. Failed error: %lu\n", GetLastError());
+
     /* test invalid source buffers */

b = VirtualProtect( src + 0x2000, 0x2000, PAGE_NOACCESS, &old_prot );
diff --git a/dlls/kernelbase/memory.c b/dlls/kernelbase/memory.c
index 4f4bba9a13b..ccc8799405d 100644
--- a/dlls/kernelbase/memory.c
+++ b/dlls/kernelbase/memory.c
@@ -537,7 +537,45 @@ BOOL WINAPI DECLSPEC_HOTPATCH VirtualUnlock( void *addr, SIZE_T size )
 BOOL WINAPI DECLSPEC_HOTPATCH WriteProcessMemory( HANDLE process, void *addr, const void *buffer,
                                                   SIZE_T size, SIZE_T *bytes_written )
 {
-    return set_ntstatus( NtWriteVirtualMemory( process, addr, buffer, size, bytes_written ));
+    NTSTATUS status, protect_status;
+    MEMORY_BASIC_INFORMATION mbi;
+    SIZE_T res_len, region_size = size;
+    ULONG old_prot;
+    void *base_addr = addr;
+
+    status = NtQueryVirtualMemory( process, addr, MemoryBasicInformation, &mbi, sizeof(mbi), &res_len );
+
+    if (!NT_SUCCESS(status)) return set_ntstatus( status );
+
+    if ((mbi.Protect & PAGE_NOACCESS) == PAGE_NOACCESS || 
+        (mbi.Protect & PAGE_READONLY) == PAGE_READONLY)
+        return set_ntstatus( STATUS_ACCESS_VIOLATION );
+
+    if ((mbi.Protect & PAGE_READWRITE) == PAGE_READWRITE ||
+        (mbi.Protect & PAGE_WRITECOPY) == PAGE_WRITECOPY)
+        return set_ntstatus( NtWriteVirtualMemory( process, addr, buffer, size, bytes_written ) );
+
+    if ((mbi.Protect & PAGE_EXECUTE_READWRITE) == PAGE_EXECUTE_READWRITE ||
+        (mbi.Protect & PAGE_EXECUTE_WRITECOPY) == PAGE_EXECUTE_WRITECOPY)
+    {
+        status = NtWriteVirtualMemory( process, addr, buffer, size, bytes_written );
+        NtFlushInstructionCache( process, addr, size );
+        return set_ntstatus( status );
+    }
+        
+    /* In the non-writeable code region case, Windows changes the protection to facilitate the write
+     * and then changes it back. */
+
+    protect_status = NtProtectVirtualMemory( process, &base_addr, &region_size, PAGE_READWRITE, &old_prot );
+    if (!NT_SUCCESS(protect_status)) return set_ntstatus( protect_status );
+
+    status = NtWriteVirtualMemory( process, addr, buffer, size, bytes_written );
+
+    protect_status = NtProtectVirtualMemory( process, &base_addr, &region_size, old_prot, &old_prot );
+    if (!NT_SUCCESS(protect_status)) return set_ntstatus( protect_status );
+
+    NtFlushInstructionCache( process, addr, size );
+    return set_ntstatus( status );
 }