2

Hypothetical Scenario: I have written a programm which runs on my machine. An attacker wants to read (not write) security-critical information from my programms memory. To achieve this, he hacked my machine, installed a programm hisself plus a kernel-driver to hide his programms process and activity.

Is it possible for me to modify my programm in the way that it (just) detects this attempt? To mark keys or whatever as possbily compromised? I am not asking for programming details.

3
  • 2
    You seem to be asking how you enforce unusual restrictions on a user-space program which can bypass restrictions imposed by the kernel. Even if it were possible to monitor reads from memory, such an approach could never be relied upon.
    – symcbean
    Sep 21, 2016 at 12:30
  • Well it is not about a 'reliable' 100% defence, just to make it harder for an attacker in this scenario. So you say it is not possible to monitor reads from memory? Sep 21, 2016 at 12:37
  • This isn't a hypothetical; it's a real problem in video games where tools like aimbots use kernel-mode mouse drivers to let players cheat. There are some kernel-mode anti-cheat programs that try to combat this with various levels of success. Sep 21, 2016 at 23:44

3 Answers 3

2

Simple answer: No.

But why? I don't know of any common OS that separates processes enough to reliably prevent or detect reading memory. In Windows, you are especially lost, unless you run in administrator mode, in which case non-privileged processes should only be able to get some limited information about you (unless it runs in privileged mode too). I can also simply freeze your "extremely secure" application, read all it's data and then simply kill it.

When attacker has a driver on it's side, you are especially lost, since now attacker is on ring0 and can essentially do anything to your system.

Would another application help? No. Nothing will help, because it's essentially playing game of "I detect X" "so i move to Y, X wont help you". If attacker knows how your application works (and this applies to any program you release), then he can think of yet another method to bypass all it's security. This is essentially what happens in online gaming, in virus development and in software cracking for years. And even multimilion companies weren't able to solve this problem.

Only help would be getting level lower than attacker is. In your case that's hardware.

1

I do not believe this is possible on standard, current platforms.

I think that you would need an independent monitoring application at the least.

UPDATE: "But a second application would definitly be able to detect this?" - hard to be definitive there, I'm afraid that I'm not quite knowledgable about Windows system programming. It is possible that it wouldn't be possible without special hardware. But if it is possible, I would expect that it would only be the case by utilising low-level system libraries.

1
  • But a second application would definitly be able to detect this? How? Sep 21, 2016 at 12:28
0

Hypotetically speaking (since you're not asking for specific details), it is possible. However it is not 100% reliable, and there are always workaround.

First, if your secure data is 1-8 bytes, and you run on x86, you can set a hardware breakpoint which will be triggered when this data is accessed. See. for example, https://github.com/mmorearty/hardware-breakpoints

If you need to protect more than 32 bytes (there are 4 hardware breakpoint registers), you can use VirtualProtect with PAGE_GUARD, or make the page unreadable (PAGE_NOACCESS).

When you need to access the data yourself, you remove the flag/breakpoint, access the data, and restore it. This of course creates the race condition, but the window of opportunity is short.

Of course if someone has an application with a kernel driver, they can remove the hardware breakpoints or change your application page flags through the kernel driver, so this will not work. However if they only use the driver to hide the application, this should work.

6
  • reading remote process memory does not trigger hardware breakpoints (since it is basically kernel-level call). Marking page with PAGE_GUARD or PAGE_NOACCESS will also lock you from it. And it can be undone with just freezing target process.
    – axapaxa
    Sep 21, 2016 at 23:16
  • "reading remote process memory does not trigger hardware breakpoints" - are you sure about that?
    – George Y.
    Sep 22, 2016 at 4:57
  • Seems like PAGE_GUARD might have applications in gaming anti-cheat. It would, at least, raise the skill ceiling for creating cheat software. May 20, 2019 at 2:40
  • 1
    One doesn't need a kernel driver to change the protection of your application's pages or to modify the CPU register values. Windows API provides functions for that, namely VirtualProtectEx and SetThreadContext. Also, guard pages turn up as such when one is walking the address space with VirtualQueryEx. Oct 4, 2019 at 16:19
  • Exactly @HristoLliev, an injected dll can easily unprotect that region and write to it. It's essentially impossible to prevent cheats in a game, that's why new ones always come out. The best way is to alter with multiplication values that are stored so they aren't detected by cheat engine but also implement logic on the server to verify all client actions. i.e, preventing an XP boosting hack by preventing client from telling it xp / kills such that the client can only notify it of a kill, verifying each game object is available to be killed and spawn timer it set before updating XP Nov 4, 2019 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .