1

I want to program a little security watchdog for my Windows 10 machine. This watchdog should start directly after boot and should be active, no matter which user is currently logged in.

None of the users should be able to see, what's happening inside the watchdog (e.g. reading out memory to detect vulnerabilities) nor should be able to manipulate or inject something to it.

Is this even possible with Windows?

Some clarification:

So here is my (hypothetical) use case: I own critcal business data which I am fetching from an external source from time to time and I am doing some business logic with it. This process shall run, whenever the computer is on.

And now I fear that other users could see my data, by watching the (unencrypted) process. Of course I could move my logic to a cloud but there I have the same problems with admins I don‘t trust.

I just wondered, under which circumstances there is total process isolation possible with windows or maybe another OS.

  • As far as I know a process is protected when run by another user (especially the Admin user.) – Alexis Wilke Jul 19 '19 at 21:23
  • Do the users have admin rights? Do you have admin rights to install/start the watchdog? Are these your computers? There are too many different possibilities which vary on these factors and also on the effort needed and they might include questionable methods like those used in DRM/rootkits. It also seems you want to do this without the consent of the users which might be legally and/or morally wrong. – H. Idden Jul 19 '19 at 22:47
  • @AlexisWilke Not from other Admin (or SYSTEM)-owned processes. Admins (or anybody else with the SeDebug privilege) can attach to any process on the system - aside from special DRM ones - and do what they like with it, including reading or even writing its memory. Assuming "None of the users should be able..." to mean any user account, that won't cut it. – CBHacking Jul 20 '19 at 2:55
2

One way to do this would be a kernel-mode software device driver (or, as other OSes would term it, a kernel module). Drivers are technically just another Windows service, in most ways (they don't show up in services.msc, but if you look in the registry, they're there alongside the user-mode services). However, they have advantages no user-mode process does. Most notably, they can read the memory of any user-space program, no matter how protected it is; with enough effort they can even read the memory of processes that run in isolated VMs on the same host. They are also in the best position to do things like make the OS lie to other processes about running processes, files and file contents, and registry keys and values; this is useful if you want to hide your service's existence.

Of course, the technical term for what you've written at this point is "rootkit". Nobody is going to want to install this thing on their own system, and if you do it without their permission you will be sued and/or arrested. It doesn't really matter what you're doing with it; no Legitimate process needs to hide itself that hard.

Additionally, there are limitations on how far you can go. Your driver can try to prevent any process from tampering with its file(s) on disk, but it can only do that while it's running; somebody with access to bootable media (such as a Windows install disk or a Linux liveCD) could easily find the files, registry entries, etc. and modify or remove them (this is, in fact, how the Sysinternals "Rootkit Revealer" tool works). Similarly, anything you can do, another driver could also do; yours might be able to prevent even another driver from noticing its existence, but only if yours starts first. Finally, a kernel debugger attached to a machine running this driver will almost certainly be able to detect (and tamper with or remove) it.

There's lots of problems with the driver approach, too. Writing drivers is tricky, and they need to be pretty much perfect. If they crash, the system goes down (BSOD). If they hang, the system may also hang. If they have security vulnerabilites, an attacker who finds one can use it to take over the machine. If they want to get really deep into the OS, they're run into parts that are not officially documented and therefore subject to changing when updates are installed, and that could turn a working driver into a crashing one (there's been a problem with pre-release "Fast ring" Windows builds and certain game DRM crashing them for months now, because the DRM was hooking parts of the kernel that it shouldn't). If they try and tamper with stuff too deep into the kernel, the kernel itself may fight back; there's a feature called "PatchGuard" that detects modification of many kernel data structures, and while you may learn to bypass one version of it, the next one might catch you. Finally, if you want to load your driver on 64-bit Windows, it will either need to be blessed by Microsoft (signed with a code signing key that authenticates your code) or will only be loadable if the kernel was booted in "testsigning" or "debug" mode. Both of these modes cause (deliberately) visible modifications to the desktop, and also disable certain parts of Windows (mostly related to media DRM), since otherwise a driver like yours could see what they're doing; to users, this will manifest as certain functions of the OS not working anymore.


There's a user-mode option if you don't want to go all the way into the kernel, but it's not going to work any better. Windows does have the concept of a "protected process" that can inspect and debug (meaning, among other things, read or write memory) other processes but cannot itself be inspected or debugged. These are called "protected processes", and while their presence is not secret, what they do is. However, protected processes cannot access as much stuff as a driver, are even harder to create than drivers (they're less delicate, but they not only must be signed, they need a special signature), and as mentioned they're less secretive.


Is there a particular reason you're trying to do this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.