X64dbg: When step over VirtualProtect, .text section gone

[xujintao]

When step over VirtualProtect (modify the .text section protect attribute from PAGE_EXECUTE_READ to PAGE_EXECUTE_READWRITE), cpu view window code disappeared, so is the .text section in Memory Map window.

x32dbg version: jun 26 2019, 20:33:30
os: windows7 64 sp1

[mrexodia]

Hello,

Thanks for reporting an issue. Please provide a binary and steps to reproduce this issue.

[xujintao]

Hi, i did a regular experiment just now. The result is that there is no VirtualProtect side effect in .text section.

int main() {
    HMODULE hImageBase = GetModuleHandle(NULL);

    DWORD oldProtect;

    // dos header
    IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)hImageBase;

    // nt header
    IMAGE_NT_HEADERS* ntHeader = (IMAGE_NT_HEADERS*)((DWORD)hImageBase + dosHeader->e_lfanew);

    // .text section header
    IMAGE_SECTION_HEADER* textSectionHeader = (IMAGE_SECTION_HEADER*)((DWORD)ntHeader + sizeof(IMAGE_NT_HEADERS));
    VirtualProtect((void*)((DWORD)hImageBase + textSectionHeader->VirtualAddress), textSectionHeader->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtect);
    printf("%d\r\n", oldProtect);
}

However, the side effect works in the exe file which is ready to be reversed.

Now, call VirtualProtect.

It's gone, strange, really show.
For some dirty little secret, i can not provide this binary recently. Is there any other ways could locate the problem or even solve it?

[mrfearless]

I think this issue, or a similar one was previously reported and may have been fixed in https://github.com/x64dbg/x64dbg/commit/d50675ca025e3494de683d8510a681551e92c8ab
I would suggest updating x64dbg to the latest version to see if the problem still occurs

[xujintao]

The latest version(2019.9.1) solved this problem.
Thanks, x32dbg helps me a lot.