Member Avatar for silverkrypt

I just dont understand why poke, absread(),abswrite(),system() and such other memory related functions do not work even if all modifications are made. Any Idea??

  • 2 Contributors
  • 4 Replies
  • 73 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by silverkrypt

Dani AI

Generated

As correctly noted, NT-family kernels enforce strict process isolation and page protections. That can let simple reads appear to work while writes fail — because writing requires the right page permissions and process privileges, and writes into kernel or physical memory are blocked from user mode. reported disabling DEP without success; DEP mainly stops execution of data pages and will not by itself allow user-mode code to modify another process or kernel memory.

Practical checklist and next steps:

  • For writes inside your own process, change the page protection first with VirtualProtect, write, then restore (VirtualProtect).
  • For another process, open it with PROCESS_VM_OPERATION|PROCESS_VM_WRITE and use VirtualProtectEx/VirtualAllocEx + WriteProcessMemory (WriteProcessMemory, VirtualProtectEx). You may need elevation and SeDebugPrivilege for protected targets.
  • For kernel or physical memory you must use a kernel-mode driver (not doable safely from user mode).
  • Always check GetLastError for the actual failure reason and test in a VM.

Minimal write sequence (conceptual):

h = OpenProcess(...PROCESS_VM_OPERATION|PROCESS_VM_WRITE..., pid);
VirtualProtectEx(h, addr, size, PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(h, addr, buf, size, NULL);
VirtualProtectEx(h, addr, size, old, &old);
CloseHandle(h);

Modifying other processes or kernel memory can crash the system and trigger security software; prefer documented APIs and work in an isolated test environment. For DEP background see Data Execution Prevention.

Recommended Answers

All 4 Replies

Member Avatar for jbennet

NT based systems are very restrictive about programs and memory for security reasons

Member Avatar for silverkrypt

NT based systems are very restrictive about programs and memory for security reasons

Thanks for replying but is there any way out?
It is fine when i try to read using peek() giving hex address range but it simply ignores poke() and i am being driven nuts tryng to work around it. Please Help! :-)

Member Avatar for jbennet

NT doesnt like it due to security. Disabling DEP helps somewhat

Member Avatar for silverkrypt

NT doesnt like it due to security. Disabling DEP helps somewhat

I already tried that and it does not help in the least. Well if there is any other way PLEASE let me know. :-|
TIA

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.