Re: [PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[eric pouech (＠epo)]

From your explanation, it rather looks that VirtualQueryEx() fails because the access rights of the process handle don't have the PROCESS_QUERY_INFORMATION bit set.
(tested on Win10 and WriteProcessMemory() succeeds if the PROCESS_QUERY_INFORMATION isn't set).
Does the attached patch works as well?

(and calling directly NtWriteVirtualMemory() doesn't look fully correct: it should follow the rest of the code to potentially change protection of some pages)

[writevirt.patch](/uploads/e2b61d4a5da0f9990c0488273dd3f834/writevirt.patch).