4

I found that many debuggers (like x64dbg) or hex viewers (HxD) allow you to access and modify memory of another process. It works without any asking for permission.

I even wrote a simple program that replaces a string in memory of other processes and it works. (It uses CreateToolhelp32Snapshot, Process32First, Process32Next functions to find the process, OpenProcess to access it, VirtualMemoryEx to get valid memory locations and ReadProcessMemory/WriteProcessMemory to read/write into it.) It could potentially be misused for malicious activity.

Why does that work? Why does Windows provide us such a functionality? Shouldn't it be more restricted?

Ahoj Lidi
  • 41
  • 1
  • 2

0 Answers0