Hello. Please tell me how you can protect the memory of your process from writing and reading? I would be very grateful, thanks in advance!
|
C#
process memory protection |
|
fuck.
![]() Not trying to be a dick, It just comes naturally.
Mar 3, 2019 01:22 AM
(This post was last modified: Mar 3, 2019 01:23 AM by 0xDEAD10CC.)
(Mar 3, 2019 12:50 AM)StarZ Wrote: https://www.pinvoke.net/default.aspx/ker...lprotectex That's not really going to help here; that function is the reason why. The question is also not descriptive enough - protect memory from read/writes from the perspective of what? The process itself, or from an observer process? You can't really protect yourself from external read/writes. You'd need to write a complicated driver to do something remotely like that.
Getting Started: C/C++
[C/C++/.NET/x86 ASM - Automation Programmer]
Mar 3, 2019 02:11 AM
(This post was last modified: Mar 3, 2019 02:13 AM by xAmka1488.)
(Mar 3, 2019 01:22 AM)0xDEAD10CC Wrote: That's not really going to help here; that function is the reason why. the process itself (Mar 3, 2019 01:22 AM)0xDEAD10CC Wrote: That's not really going to help here; that function is the reason why. I want to create a secure program in which will be anti dll inject, anti dump, anti Write Write ProcessMemory / ReadProcessMemory, anti tamper. And so on
Mar 3, 2019 10:51 AM
(This post was last modified: Mar 3, 2019 10:52 AM by Vexallus.)
you can't just do this with .NET, you need top level accessibility in order to do such thing , aka a Driver, just like those games running xigncode3 , apex shield ,Battle-eye etc...
my advise for you is to have a look for a decent obfuscator and include your own protection, you can pretty much make everything protected if you know what you are doing. Also even if you use drivers to protect your memory privileges, there will be always a way, C.E itself is using a kernel driver that has a full access over memory even if its protected, so yeah...better change your ideas about that.
This task is generally unsolvable.
Private solution: write a driver that sniffs the opening functions process (XP-Srv2003) or will use a special kernel API for its protection (Vista SP1 and above) and thus will not allow to write to the process memory. This saves from ~ 90% of typical threats. Now if the attacker is not able to get on computer administrator rights, then everything would be much easier. In this case, it would be enough to run your process under another account because they don't have access by default each other's processes. |
|
|




![[Image: wyEbCMi.png]](https://i.imgur.com/wyEbCMi.png)
