I'm currently researching memory injection attacks on games in Windows 7/10.
After reviewing several threads on this topic, there's a few questions which are still unclear.
DLL injection can be easily detected by using introspection. Even if you patch and sign an existing DLL, the SHA1 will mismatch and cause red flags, assuming the game client has detection for all this. Correct?
Memory injection can be used to inject malicious code, however this can apparently only be achieved by using a signed kernel module as the memory space is protected from being read/written by other processes. Correct?
If a kernel module is used to inject into a processes memory, is the process able to detect this? For example, lets say there's a string in memory which points to a disk path (
/conf/something.cnf), if that was overwritten with a string with the exact same length, would the process be able to detect that memory was overwritten?