3 ms·
They also act as access alarms[1]. Why even comment if you didn't bother to read the docs? > The PAGE_GUARD protection modifier establishes guard pages. Guard
by dvt 5mo ago
They also act as access alarms[1]. Why even comment if you didn't bother to read the docs?
> The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages.
[1] https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualprotect?source=recommendations https://learn.microsoft.com/en-us/windows/win32/api/memoryap...
- Dwedit 5mo agoGuard pages are for the process that creates them, they're not for the other processes that try to read the memory.
- dvt 5mo agoAbsolutely wrong. Are we writing the same code here? Page guards are for all userspace access. (In fact, I think kernel space might also trigger them, but can be circumvented. PS: I'm being polite :) Kernel space 100% triggers them, but can be cleverly circumvented by fucking with logs.)
- Hikikomori 5mo agoCould you not use VirtualProtectEx to strip PAGE_GUARD? Even so, none if these methods offer protection, at best you can get some detection, but that doesn't matter when they got your passwords already.
- dvt 5mo ago[dead]