Hypothetical Scenario: I have written a programm which runs on my machine. An attacker wants to read (not write) security-critical information from my programms memory. To achieve this, he hacked my machine, installed a programm hisself plus a kernel-driver to hide his programms process and activity.

Is it possible for me to modify my programm in the way that it (just) detects this attempt? To mark keys or whatever as possbily compromised? I am not asking for programming details.

  • 2
    You seem to be asking how you enforce unusual restrictions on a user-space program which can bypass restrictions imposed by the kernel. Even if it were possible to monitor reads from memory, such an approach could never be relied upon. – symcbean Sep 21 '16 at 12:30
  • Well it is not about a 'reliable' 100% defence, just to make it harder for an attacker in this scenario. So you say it is not possible to monitor reads from memory? – Martin Tausch Sep 21 '16 at 12:37
  • This isn't a hypothetical; it's a real problem in video games where tools like aimbots use kernel-mode mouse drivers to let players cheat. There are some kernel-mode anti-cheat programs that try to combat this with various levels of success. – Robert Fraser Sep 21 '16 at 23:44

Simple answer: No.

But why? I don't know of any common OS that separates processes enough to reliably prevent or detect reading memory. In Windows, you are especially lost, unless you run in administrator mode, in which case non-privileged processes should only be able to get some limited information about you (unless it runs in privileged mode too). I can also simply freeze your "extremely secure" application, read all it's data and then simply kill it.

When attacker has a driver on it's side, you are especially lost, since now attacker is on ring0 and can essentially do anything to your system.

Would another application help? No. Nothing will help, because it's essentially playing game of "I detect X" "so i move to Y, X wont help you". If attacker knows how your application works (and this applies to any program you release), then he can think of yet another method to bypass all it's security. This is essentially what happens in online gaming, in virus development and in software cracking for years. And even multimilion companies weren't able to solve this problem.

Only help would be getting level lower than attacker is. In your case that's hardware.

| improve this answer | |

I do not believe this is possible on standard, current platforms.

I think that you would need an independent monitoring application at the least.

UPDATE: "But a second application would definitly be able to detect this?" - hard to be definitive there, I'm afraid that I'm not quite knowledgable about Windows system programming. It is possible that it wouldn't be possible without special hardware. But if it is possible, I would expect that it would only be the case by utilising low-level system libraries.

| improve this answer | |
  • But a second application would definitly be able to detect this? How? – Martin Tausch Sep 21 '16 at 12:28

Hypotetically speaking (since you're not asking for specific details), it is possible. However it is not 100% reliable, and there are always workaround.

First, if your secure data is 1-8 bytes, and you run on x86, you can set a hardware breakpoint which will be triggered when this data is accessed. See. for example, https://github.com/mmorearty/hardware-breakpoints

If you need to protect more than 32 bytes (there are 4 hardware breakpoint registers), you can use VirtualProtect with PAGE_GUARD, or make the page unreadable (PAGE_NOACCESS).

When you need to access the data yourself, you remove the flag/breakpoint, access the data, and restore it. This of course creates the race condition, but the window of opportunity is short.

Of course if someone has an application with a kernel driver, they can remove the hardware breakpoints or change your application page flags through the kernel driver, so this will not work. However if they only use the driver to hide the application, this should work.

| improve this answer | |
  • reading remote process memory does not trigger hardware breakpoints (since it is basically kernel-level call). Marking page with PAGE_GUARD or PAGE_NOACCESS will also lock you from it. And it can be undone with just freezing target process. – axapaxa Sep 21 '16 at 23:16
  • "reading remote process memory does not trigger hardware breakpoints" - are you sure about that? – George Y. Sep 22 '16 at 4:57
  • Seems like PAGE_GUARD might have applications in gaming anti-cheat. It would, at least, raise the skill ceiling for creating cheat software. – Scuba Steve May 20 '19 at 2:40
  • 1
    One doesn't need a kernel driver to change the protection of your application's pages or to modify the CPU register values. Windows API provides functions for that, namely VirtualProtectEx and SetThreadContext. Also, guard pages turn up as such when one is walking the address space with VirtualQueryEx. – Hristo Iliev Oct 4 '19 at 16:19
  • Exactly @HristoLliev, an injected dll can easily unprotect that region and write to it. It's essentially impossible to prevent cheats in a game, that's why new ones always come out. The best way is to alter with multiplication values that are stored so they aren't detected by cheat engine but also implement logic on the server to verify all client actions. i.e, preventing an XP boosting hack by preventing client from telling it xp / kills such that the client can only notify it of a kill, verifying each game object is available to be killed and spawn timer it set before updating XP – Lewis Kelsey Nov 4 '19 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.