views:

185

answers:

6

I thought that one processes cannot read the memory of another process. But I'm shocked to see an application named "WinHex" which has "Ram Editor" and it is able to access entire memory. of all the processes.

How is that possible? And it is even able to modify the memory of other processes. Doesn't this become malicious?

A: 

If you're running as Administrator, you can obtain privileges to read all of memory; it seems that WinHex is doing this on your behalf.

Have you tried this on a more restricted account?

Carl Smotricz
A: 

I think it uses some DLL injection technique.

Salv0
+1  A: 

Well, that's one of the things a process with the right privileges, granted by the operating system, can do. Processes cannot access other processes' memory in principle. In practice the underlying operating system usually offers this mechanism to privileged processes.

pau.estalella
A: 

This is how it's done, with sample code.

http://www.codeproject.com/KB/threads/MDumpAll.aspx

Ehrann Mehdan
+3  A: 

In all likelyhood, the tool uses ReadProcessMemory or some variant, which requires PROCESS_VM_READ access.

With respect to your "malicious" comment, remember that you (or the process invoking this API, which likely needs Administrator-level permissions) already has total control over the machine. The security game is already lost at this point.

Michael Petrotta
Alice
A: 

Accessing other process' memory is a piece of cake.
You can even use Windows Driver Kit to access and modify everything.

Check out for example rootkits to see how fragile is the OS when you don't restrict programs' privileges.

Nick D
`ReadProcessMemory or some variant, which requires PROCESS_VM_READ access`.1. Will this come under Windows Driver Kit? 2. Will these programs be running in kernel mode for acessing entire memory?
Alice
Nick D