Reply to thread

Message

<blockquote data-quote="436880927" data-source="post: 828052">MemProtect cannot &quot;stop&quot; DLL injection. MemProtect can prevent handle creation and duplication (or threads) of the processes it is &quot;protecting&quot;.Handles to processes or threads you can access based on your privilege level in user-mode (Windows integrity) can be acquired without MemProtect being able to stop you. I&#039;m just not going to tell you how.In the Windows kernel, you do not have to open a handle to a process or thread.In the Windows kernel, you can target physical memory or attach to a specific process and target the pages in virtual memory... without ever messing with process or thread handles.Protected process mechanisms working in the Windows kernel can be disabled temporarily by others running with a CPL of 0, and then re-enabled after required modifications are performed. Such can be done before the process executes code from it&#039;s own image.Good AVs already have kernel-mode software.Get it?</blockquote>

[QUOTE="436880927, post: 828052"] MemProtect cannot "stop" DLL injection. MemProtect can prevent handle creation and duplication (or threads) of the processes it is "protecting". Handles to processes or threads you can access based on your privilege level in user-mode (Windows integrity) can be acquired without MemProtect being able to stop you. I'm just not going to tell you how. In the Windows kernel, you do not have to open a handle to a process or thread. In the Windows kernel, you can target physical memory or attach to a specific process and target the pages in virtual memory... without ever messing with process or thread handles. Protected process mechanisms working in the Windows kernel can be disabled temporarily by others running with a CPL of 0, and then re-enabled after required modifications are performed. Such can be done before the process executes code from it's own image. Good AVs already have kernel-mode software. Get it? [/QUOTE]

Verification