Re[4]: Protecting code and data in Windows

From: Eric Landuyt (eric_at_datarescue.com)
Date: 10/03/03

  • Next message: Joe McCray: "Requesting help with Unix wargame server development" 
    Date: Fri, 3 Oct 2003 09:32:17 +0200
To: secprog@securityfocus.com

    Hello,

    Thursday, October 02, 2003, 9:12:49 PM, you wrote:

    DE> How about using something like VirtualProtectEx() and set the memory storing
    DE> the key to PAGE_GUARD. If anything tried to access that page you would get
    DE> an alarm/exception of STATUS_GUARD_PAGE. Any time you need to read the key
    DE> you can promote the access state to PAGE_READONLY to do the read, then
    DE> demote it back to PAGE_GUARD when done. The result here would be that if
    DE> anything tries to touch that memory when it SHOULDN'T, you could get a
    DE> chance to defend against it or fail securely.

    This approach could be interesting to "protect" from malicious code
    injected in the process itself: Windows itself uses such a mechanism
    to implement automatic stack checking (see [1]).
    However, another process (with Debug Programs privilege) which will use
    ReadProcessMemory() [2] to access the memory of our protected process
    will not generate such STATUS_GUARD_PAGE exception in the context of
    this protected process...

    More generally, another process with Debug Programs privilege has
    an almost unlimited set of possibilities to access data, manipulate
    the execution flow, ... of another process (think
    WriteProcessMemory(), CreateRemoteThread(), SetThreadContext(), ...).
    So the first problem to soluce will be to avoid such a debugger
    to attach to our critical process. Once a debugger can attach, the
    game is over.

    Best regards, 

    ---
[1] http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memory/base/creating_guard_pages.asp
[2] http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/readprocessmemory.asp
--
Eric Landuyt, Developer - mailto:eric@datarescue.com
DataRescue sa/nv, Home of the IDA Pro Disassembler - http://www.datarescue.com
  • Next message: Joe McCray: "Requesting help with Unix wargame server development"

    Relevant Pages

    • Re: Memory Issue
      ... If I let the app run for 20 minutes it runs out of memory. ... Unfortunately after you attach a debugger 20 minutes might turn into 20,000 minutes. ... Get a debugger or other performance tool, attach it and let the process run. ...
      (comp.lang.java.help)
    • RE: Memory growth halts with use of Profiler - bug in .NET services?
      ... unless I attach a debugger to it. ... application instead of as a service, I have no memory problems at all. ... I'll try the SOS debugger and also the CLRProfiler, ... This is basically the manual version of what CLRProfiler does; ...
      (microsoft.public.dotnet.framework.performance)
    • System Idle Process
      ... According to TaskManager, this process uses some memory (seem to be ... It is not possible to attach a debugger to ...
      (microsoft.public.win32.programmer.kernel)
    • Re: Disable usb devices bring out of standby
      ... >>> In memory of Alex Nichol ... >>> Folder customizations ... >>> Protect your PC! ...
      (microsoft.public.windowsxp.customize)
    • Re: [Full-disclosure] Google Talk cleartext credentials in processmemory
      ... operating system already presents a means to protect against one process ... another process's memory, then you've already lost, it's too late. ... process's memory at the moment that it had the password in cleartext. ...
      (Full-Disclosure)