3 ms·

Isn't this a way to introduce bugs? For example: - injected DLL can change some process-related settings and break main program - injected DLL can call non-re

• bmm6o 5y ago
  No need to go that far. If you allow an untrusted process to write to your memory, you've already lost. One thing I haven't seen called out yet is that there is security associated with this API call - ordinary users can only call this on processes that they own. (And as far as the terminology, these aren't "bugs" since they aren't defects in the software.)
• barchar 5y ago
  I mean sure. If you can do this you can debug the process (how do you think debuggers are implemented?) and ofc once you're debugging a process you can introduce bugs and cause random havoc. Linux can do this too with ptrace. And mac has something similar I'm sure, you gotta be able to debug. Now, the target process can implement countermeasures against you, that's what anti-debug is, but it's impossible in the general case to defend yourself against a debugger with the same privilege level as you. (it is an arms race though, so sometimes it's easiest to resort to kernel-mode anti-anti-debug techniques even against pure user-mode anti-debug. If you do that you need to disable KPP, and you can't disable KPP in the supported way because the supported way is to attach a kernel debugger to the kernel, which will make it obvious that someone is debugging!)