CODEWITHSUNDEEP
c#securitymemory
CodeCamper
CodeCamper

Reputation: 6980

Detect memory reading and change variable?

I have a simple Console application with the variable X = 10. I then have a loop which asks the user to change the variable and output. I attach a debugger and edit the memory region of my program to change the variable X. What can I do to prevent the user from editing this X variable with a memory editor and also is there anyway of detecting(in my program) debuggers or memory editors such that when variable X is accessed move variable X somewhere else and when variable X is changed send a message to the user that you shouldn't be doing that? This is just an educational experiment of mine.

For example in the code below

        byte X = 10;
        X = byte.Parse(Console.ReadLine()); // scan memory looking for X to change
        Console.ReadKey(); // Change X before the output
        Console.WriteLine("X = " + X);

X can easily be edited before the program outputs and even with a couple other fancy pointer tricks it can still be edited easily before the output with a simple external program.

Upvotes: 1

Views: 1166

Answers (1)

Jon Skeet
Jon Skeet

Reputation: 1500145

No. Fundamentally if you've got a user with enough access that they can poke around in another process's memory, there's not a lot you can do.

This is very rarely an issue in my experience, however.

If it's really a problem in your case, you could potentially reduce the attack space by only maintaining values in an encrypted form - then have a "working space" for unencrypted data, which is only trusted immediately after decryption, and wiped after use. It doesn't completely eradicate the attack vector, but it could reduce it.

Upvotes: 3

Related Questions