VmTopDown

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"



#define ProcessMemoryAllocationMode 0x2E

extern "C"
{
    int __stdcall ZwAllocateVirtualMemory(HANDLE,unsigned long*,
                                unsigned long,unsigned long*,unsigned long,unsigned long);
    int __stdcall ZwSetInformationProcess(HANDLE,unsigned long,void*,unsigned long);
}


int main(int argc, char* argv[])
{
    //The following function call sets the "VmTopDown" bit flag of the "_EPROCESS"
        //structure to true.
    //Hence all subsequent memory allocations are TopDown.
    unsigned long VmTopDown=1;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessMemoryAllocationMode,&VmTopDown,0x4);
    if(ret<0) printf("Error %x\r\n",ret);
    else
    {
        unsigned long Size=0x1000;
        unsigned long Base=0;
        ret=ZwAllocateVirtualMemory(GetCurrentProcess(),&Base,0,&Size,MEM_RESERVE,PAGE_READWRITE);
        if(ret<0) printf("Error %x\r\n",ret);
        else printf("Memory reserved at %x\r\n",Base);
    }
    return 0;
}