Memory Editing

I'm making a program that needs to access the memory, etc.. of target programs. Virii and spyware often have a lot of read/write/terminate protection, and that's where I need help. My program gives itself debug rights, but some programs still don't allow PROCESS_VM_WRITE or PROCESS_TERMINATE.

How do these programs keep me from writing or terminating, even though I've given myself access? And how can I overcome this?

Here are my active functions:

In main():

Code:

---

HANDLE hToken;
  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) {
      EnablePrivilege(hToken, SE_DEBUG_NAME, TRUE) ;
      CloseHandle(hToken);
      }

---

EnablePrivilege():

Code:

---

BOOL EnablePrivilege(HANDLE hToken, LPCTSTR szPrivName,
  BOOL fEnable) {

  TOKEN_PRIVILEGES tp;
  tp.PrivilegeCount = 1;
  LookupPrivilegeValue(NULL, szPrivName, &tp.Privileges[0].Luid);
  tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
  AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
  return((GetLastError() == ERROR_SUCCESS));
}

---

When set to PROCESS_VM_WRITE or PROCESS_TERMINATE, m_hProcess goes unchanged [NULL]. PROCESS_VM_READ is allowed on all programs, even those that deny access when I don't set permissions. It sets m_hProcess to a handle, like it should.

Code:

---

m_hProcess = ::OpenProcess(PROCESS_VM_READ, false, _PID)

---

This is Windows, right?

The operating system prevents you from accessing another program's memory, or the operating system's memory space. As far as I know, you can't do this with a user-mode program. So, I think you have to write a kernel-mode (driver) program.

Yes this is Windows XP.

I've read and written memory to multiple programs. Programs related in no way to mine. A few deny me access.

Could this be a hook they've initialized on the DLL I'm accessing? Either way, would a DLL hook be a solution?

I don't know what exactly you're trying to do but have you tried using ReadProcessMemory/WriteProcessMemory ? As far as I know, you don't need an privileges to use them and they work on all windows programs.

Quote:

---

Originally Posted by durban

I don't know what exactly you're trying to do but have you tried using ReadProcessMemory/WriteProcessMemory ? As far as I know, you don't need an privileges to use them and they work on all windows programs.

---

Can't WriteProcessMemory or ReadProcessMemory without the correct handle.

For example.
This grabs the ReadProcessMemory handle:

Code:

---

m_hProcess = ::OpenProcess(PROCESS_VM_READ, false, _PID)

---

This grabs the WriteProcessMemory handle:

Code:

---

m_hProcess = ::OpenProcess(PROCESS_VM_WRITE, false, _PID)

---

My access to the handle is denied with PROCESS_VM_WRITE. And I can't write anything without the handle.

Hmm, try using PROCESS_ALL_ACCESS.

I don't have access to any but _READ