VirtualProtect function

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows 11, Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows XP
memoryapi.h header

Syntax


BOOL VirtualProtect(
  _In_ LPVOID lpAddress,
  _In_ SIZE_T dwSize,
  _In_ DWORD flNewProtect,
  _Out_ PDWORD lpflOldProtect
);

Parameters

Parameter Description
lpAddress A pointer to the base address of the region of pages to be protected.
This parameter can be the value returned by VirtualAlloc.
If the region is not page-aligned, VirtualProtect fails and returns 0.
The memory address must be within the accessible address space of the calling process.
dwSize The size, in bytes, of the region of pages to be protected.
The region of memory that contains the address specified by lpAddress and of size dwSize must be the same as the region of memory specified when the region was allocated by a call to VirtualAlloc or VirtualAllocEx.
If the value of the dwSize parameter is larger than the actual size of the region of pages that contains the address specified by lpAddress, the function fails.
flNewProtect The new protection for the region of pages.
This parameter can be one of the memory protection constants:
  • PAGE_EXECUTE
  • PAGE_EXECUTE_READ
  • PAGE_EXECUTE_READWRITE
  • PAGE_EXECUTE_WRITECOPY
  • PAGE_NOACCESS
  • PAGE_READONLY
  • PAGE_READWRITE
  • PAGE_WRITECOPY
  • PAGE_TARGETS_INVALID
  • PAGE_TARGETS_NO_UPDATE

You cannot specify PAGE_GUARD with any other page protection type.
lpflOldProtect A pointer to a DWORD value that receives the old protection value of the first page in the specified region of pages.
If this parameter is NULL, the old protection value is not returned.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is 0. To get extended error information, call GetLastError.

Remarks

This function changes the access protection for an existing region of committed pages in the virtual address space of the calling process. The region of pages must have the same protection attribute.

To translate the return value of this function into the constants it uses, see Memory Protection Constants.

The VirtualProtect function can be used to set the protection of any page within the process's virtual address space, including pages that are not allocated by a call to VirtualAlloc. However, if you attempt to change the protection of a page that has not been allocated (e.g., a page that has not been committed), the function will fail.

The PAGE_EXECUTE_READWRITE and PAGE_READWRITE flags are the most commonly used for modifying memory. However, using these flags can have performance implications due to the need for the operating system to manage memory write permissions.

For security reasons, it is recommended to set memory pages to the least permissive access rights possible for the task at hand. For example, if a page is only intended to be read, use PAGE_READONLY. If it needs to be read and executed, use PAGE_EXECUTE_READ.

The VirtualProtect function is used to change the protection on a specified range of pages. The range of pages is specified by the lpAddress parameter and the dwSize parameter.

When using PAGE_GUARD, a STATUS_GUARD_PAGE_VIOLATION exception is raised by hardware the first time that an attempt is made to access any page in the region specified by the lpAddress parameter.

If the system raises a guard page exception for a page, the system clears the guard attribute for that page. Thus, subsequent accesses to the page do not raise a guard page exception. Therefore, to access all pages in a region, you must use VirtualProtect to set the guard attribute for each page.

Requirements

Minimum supported client: Windows Vista

Minimum supported server: Windows Server 2008

Header: memoryapi.h (include windows.h)

Library: Kernel32.lib

DLL: Kernel32.dll