3 ms·
Guard pages are one-shot exceptions used for growing the stack.
by Dwedit 6mo ago
Guard pages are one-shot exceptions used for growing the stack.
- dvt 6mo agoThey also act as access alarms[1]. Why even comment if you didn't bother to read the docs? > The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages. [1] https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualprotect?source=recommendations https://learn.microsoft.com/en-us/windows/win32/api/memoryap...
- Dwedit 6mo agoGuard pages are for the process that creates them, they're not for the other processes that try to read the memory.
- dvt 6mo agoAbsolutely wrong. Are we writing the same code here? Page guards are for all userspace access. (In fact, I think kernel space might also trigger them, but can be circumvented. PS: I'm being polite :) Kernel space 100% triggers them, but can be cleverly circumvented by fucking with logs.)
- Hikikomori 6mo agoCould you not use VirtualProtectEx to strip PAGE_GUARD? Even so, none if these methods offer protection, at best you can get some detection, but that doesn't matter when they got your passwords already.
- dvt 6mo ago[dead]