Re: WriteProcessMemory

From: Pavel Lebedinsky (m_pll)
Date: 01/08/05

  • Next message: Sam Hobbs: "Re: WriteProcessMemory" 
    Date: Sat, 8 Jan 2005 13:06:05 -0800

    WriteProcessMemory was designed to be used for debugging not
    IPC, and using it as an IPC mechanism is a bit unusual to say the
    least.

    WriteProcessMemory is not even in the same league as full
    blown IPC mechanisms like named pipes, so
    it doesn't make
    sense to compare them. The next closest thing are memory
    mapped files and even compared to them WriteProcessMemory
    has a bunch of problems:

    1. WriteProcessMemory is fragile because it requires one
    process to know the virtual memory layout of another
    process.

    2. It's all-or-nothing in terms of security. Once you give another
    process rights to write stuff to your address space, it can do
    anything - corrupt your data, inject code etc. With memory
    mapped files two processes can safely share an isolated region
    of memory without giving each other rights to read or modify
    arbitrary parts of their address space.

    3. It's slower. Every time you need to read or write something
    you have to make a system call. With memory mapped files
    you just read or write directly to memory.

    "Sam Hobbs" wrote:

    > Is there any security reason to not use WriteProcessMemory?
    >
    > I assume there is, but I can't find anything saying so.
    >
    > I know of two well-respected programmers in each of two programming forums
    > that insist that WriteProcessMemory and ReadProcessMemory are valid IPC
    > mechanisms. I assume that if they were valid and worth recommending to
    > others that they be used, that they would be listed in the IPC section of
    > the SDK documentation.
    >
    > I found one thing that is close to the type of thing I am looking for; see
    > "The arms race between programs and users" at:
    >
    > http://blogs.msdn.com/oldnewthing/archive/2004/02/16/73780.aspx
    >
    > which asks: "What's to prevent a virus from doing the same thing?"
    >
    > I don't understand Windows security well enough to be authoritive, but I
    > know that WriteProcessMemory requires PROCESS_VM_WRITE and
    > PROCESS_VM_OPERATION access. I assume that most programmers need to have
    > that level of access and also debug access (which includes the others?) in
    > order to debug their programs. For most non-programmer users, it is best
    > to avoid use of these access rights, right? Is it valid for a programmer
    > to require use of these access rights for use of their programs by others?

  • Next message: Sam Hobbs: "Re: WriteProcessMemory"

    Relevant Pages

    • Re: WriteProcessMemory
      ... CodeGuru Forums - Memory problem in C ... So the subject there is ReadProcessMemory, ... WriteProcessMemory, although I used WriteProcessMemory for the subject here. ... Is ReadProcessMemory normally considered an IPC ...
      (microsoft.public.platformsdk.security)
    • Re: Shared Memory for Application/Communication decoupling
      ... different IPC methods within a single task will introduce a lot of ... memory techniques are just a nice way of saying 'global data'. ... A messaging based interface is generally more elegant and arguably more ...
      (comp.arch.embedded)
    • Re: WriteProcessMemory
      ... There's no mention of them in the list of supported IPC methods: ... > WriteProcessMemory for the subject here. ... Note that Mick is a Forums ... > ReadProcessMemory and WriteProcessMemory are not as useful as Mick ...
      (microsoft.public.platformsdk.security)
    • Re: WriteProcessMemory
      ... Even if they are not documented as being valid for IPC, ... could exist using ReadProcessMemory and WriteProcessMemory for IPC. ... >> order to convince others, I need to get people such as you to say things ...
      (microsoft.public.platformsdk.security)
    • Re: IPC
      ... Lisa Pearlson wrote: ... > Is IPC one particular method, with certain API's or is IPC just a general ... > terminology for any method of communication between two processes, ... > via shared memory or something? ...
      (microsoft.public.vc.mfc)