Add filter for VBCrypter anti-ntdll-write protection as it breaks Ice…

…dID.
kevoreilly · Mar 26, 2019 · f4fe2d5 · f4fe2d5
1 parent 5052658
commit f4fe2d5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/hook_process.c b/hook_process.c
@@ -775,7 +775,7 @@ HOOKDEF(NTSTATUS, WINAPI, NtProtectVirtualMemory,
     PTRACKEDREGION TrackedRegion;
 #endif
 
-	if (NewAccessProtection == PAGE_EXECUTE_READWRITE && BaseAddress && NumberOfBytesToProtect &&
+	if (NewAccessProtection == PAGE_EXECUTE_READWRITE && BaseAddress && NumberOfBytesToProtect && *NumberOfBytesToProtect >= 0x2000 &&
 		GetCurrentProcessId() == our_getprocessid(ProcessHandle) && is_in_dll_range((ULONG_PTR)*BaseAddress)) {
 		unsigned int offset;
 		char *dllname = convert_address_to_dll_name_and_offset((ULONG_PTR)*BaseAddress, &offset);