VirtualAllocEx调用返回ERROR_ACCESS_DENIED错误排查求助

我的LibInjector程序尝试在Recipient进程中分配内存时，VirtualAllocEx调用失败，GetLastError()返回错误码5（ERROR_ACCESS_DENIED）。该程序在常规进程（如自行编写的其他程序或notepad.exe）中可正常运行，仅在Recipient这个特定进程中出现此问题。

相关代码 #

#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
int main(int argc, char* argv[])
{
    if (argc != 3)
    {
        printf("Usage: LibInjector [receiver process ID] [dll name]!\n");
        return 1;
    }
    int iProcessId = atoi(argv[1]);
    if (!iProcessId)
    {
        printf("Failed to parse process ID! Current process ID will be used.\n");
        iProcessId = GetCurrentProcessId();
    }
    const char* psDllName = argv[2];
    printf("Receiver process id: %d\n", iProcessId);
    //PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
    HANDLE hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, iProcessId);
    if (hTargetProcess == NULL)
    {
        printf("OpenProcess failed with code %d !\n", GetLastError());
        return 2;
    }
    SIZE_T stDllNameLen = strlen(psDllName);
    LPVOID lpDllNameAddress = VirtualAllocEx(hTargetProcess, NULL, stDllNameLen + 1, MEM_COMMIT, PAGE_READWRITE);
    if (lpDllNameAddress == NULL)
    {
        printf("VirtualAllocEx failed with code %d !\n", GetLastError());
        return 3;
    }
    //unreachable
}

环境信息 #

• LibInjector与Recipient均为32位平台进程；
• 两个进程由同一用户运行；
• 两个进程均拥有高权限；
• 高权限运行的Process Explorer显示Recipient的Protection字段为空；
• 曾修改Recipient的PE可选头中Security Directory的VirtualAddress和Size为0以移除数字签名，但问题仍存在。

更新信息 #

• RtlGetLastNtStatus返回0xC0000022，含义为“{Access Denied} 进程请求对象访问但未获相应权限”；
• 调用GetSecurityInfo(hTargetProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION, NULL, NULL, &dacl, &sacl, &pSecDesc);返回错误码5。

内容的提问来源于stack exchange，提问作者Borsh Korolevsky