Undocumented functions of NTDLL

2OOO, 5 December

NTSYSAPI 
NTSTATUS
NTAPI
NtProtectVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress,
  IN OUT PULONG           NumberOfBytesToProtect,
  IN ULONG                NewAccessProtection,
  OUT PULONG              OldAccessProtection );

ProcessHandle
Handle to Process Object opened with PROCESS_VM_OPERATION access.

*BaseAddress
Pointer to base address to protect. Protection will change on all page containing specified address. On output, BaseAddress will point to page start address.

NumberOfBytesToProtect
Pointer to size of region to protect. On output will be round to page size (4KB).

NewAccessProtection
One or some of PAGE_... attributess.

OldAccessProtection
Receive previous protection.