title: How to change the protection of memory address in kernel (Windows)
body: <pre class="lang-c prettyprint-override"><code>#pragma warning(disable: 4100)
  
  #include &quot;UnexDriver.h&quot; // includes print() and GetKernelProcAddress()
  
  LONGLONG someFunction() {
      return 10;
  }
  
  typedef NTSTATUS(_stdcall* ZwProtectVirtualMemory_t)(IN HANDLE ProcessHandle, IN PVOID* BaseAddress, IN SIZE_T* NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection);
  
  NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath) {
  
      UNREFERENCED_PARAMETER(pRegistryPath);
  
      pDriverObject-&gt;DriverUnload = UnloadDriver;
      
      ZwProtectVirtualMemory_t ZwProtectVirtualMemory = (ZwProtectVirtualMemory_t)GetKernelProcAddress(L&quot;ZwProtectVirtualMemory&quot;);
  
      char bytes[] = { 0x48, 0xc7, 0xc0, 0x01, 0x00, 0x00, 0x00, 0xc3};
  
      ULONG cp = 0;
      SIZE_T sz = sizeof(bytes);
      PVOID baseAddr = (PVOID)&amp;someFunction;
  
      ZwProtectVirtualMemory(NtCurrentProcess(), &amp;baseAddr, &amp;sz, PAGE_EXECUTE_READWRITE, &amp;cp);
      memcpy((void*)&amp;someFunction, bytes, sizeof(bytes));
      ZwProtectVirtualMemory(NtCurrentProcess(), &amp;baseAddr, &amp;sz, cp, &amp;cp);
  
      print(&quot;%lld&quot;, someFunction());
  
      return STATUS_SUCCESS;
  }
  
  NTSTATUS UnloadDriver(PDRIVER_OBJECT pDriverObject) {
  
      UNREFERENCED_PARAMETER(pDriverObject);
      
      return STATUS_SUCCESS;
  }
  </code></pre>
  <p>I am trying to make a basic hook like that but I always get crash called &quot;ATTEMPT_TO_WRITE_READONLY_MEMORY&quot; so I think there are some problems on changing the protection of memory address. I made a search to find a function to change memory protection on kernel but I couldn't find any. Do anybody know?</p>