Can "ZwProtectVirtualMemory" bypassed mechanism be improved to avoid being used by hackers
Posted: Wed Nov 10, 2021 11:21 am
"ZwProtectVirtualMemory" protection can be easily bypassed,
so it is easy to code patch the protected module memory.
Can this bypassed mechanism be improved to avoid being used by hackers.
By reloading the "ntdll. DLL" component and calling the copy function body
of "ZwProtectVirtualMemory", the "ZwProtectVirtualMemory" function of vmprotect hook is bypassed.
so it is easy to code patch the protected module memory.
Can this bypassed mechanism be improved to avoid being used by hackers.
By reloading the "ntdll. DLL" component and calling the copy function body
of "ZwProtectVirtualMemory", the "ZwProtectVirtualMemory" function of vmprotect hook is bypassed.
- 5E5EAF47-0094-4452-BE25-761DBC472D4A.png (32.82 KiB) Viewed 3494 times