#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

#define NTSTATUS            LONG
#define NT_SUCCESS(Status)  ((LONG)(Status) >= 0L)
#define NTAPI               WINAPI
#define NtCurrentProcess()  ((HANDLE) -1)
typedef NTSTATUS (NTAPI *ALLOC_PAGE_PROTO)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);
ALLOC_PAGE_PROTO            ZwAllocateVirtualMemory = NULL;

int main(int argc, char *argv[]) {
    HMODULE hModNtDLL = GetModuleHandle(TEXT("ntdll.dll"));
    if(!hModNtDLL) {
        fprintf(stderr, "[!] This example must be run under Windows NT family!\n");
        return EXIT_FAILURE;
    }

    ZwAllocateVirtualMemory = (ALLOC_PAGE_PROTO) GetProcAddress(hModNtDLL, "ZwAllocateVirtualMemory");
    if(!ZwAllocateVirtualMemory)
        return EXIT_FAILURE;

    PVOID   lpAddrTrick = (PVOID) 1;    // 0x00000001
    SIZE_T  sMemSize    = 0x1000;       // 4KB (1 page)
    NTSTATUS status = ZwAllocateVirtualMemory(NtCurrentProcess(), &lpAddrTrick, 0UL, &sMemSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if(NT_SUCCESS(status)) {
        *(int *)NULL = 1234;
        printf("[+] *(int *)NULL = %d\n", *(int *)NULL);
    } else {
        fprintf(stderr, "[!] ZwAllocateVirtualMemory failed! NTSTATUS code = 0x%08lX\n", status);
        return status;
    }

    return EXIT_SUCCESS;
}