Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They also act as access alarms[1]. Why even comment if you didn't bother to read the docs?

> The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages.

[1] https://learn.microsoft.com/en-us/windows/win32/api/memoryap...



Guard pages are for the process that creates them, they're not for the other processes that try to read the memory.


Absolutely wrong. Are we writing the same code here? Page guards are for all userspace access. (In fact, I think kernel space might also trigger them, but can be circumvented. PS: I'm being polite :) Kernel space 100% triggers them, but can be cleverly circumvented by fucking with logs.)


Could you not use VirtualProtectEx to strip PAGE_GUARD?

Even so, none if these methods offer protection, at best you can get some detection, but that doesn't matter when they got your passwords already.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: