Question

I am using VirtualAllocEx in Delphi to reserve memory in a foreign process like this:

var
 p : pointer;
begin
 p := VirtualAllocEx(Process, nil, SizeOf(Integer), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
end;

The ProcessHandle has been opened with PROCESS_ALL_ACCESS before.

After that my program writes a simple integer value to the allocated address like this:

WriteProcessMemory(Process, p, @MyInteger, SizeOf(Integer), BytesWritten);

Since the address is stored in p – I can save the address to use it for another application. The other application has to open the foreign process again to access/write the address in the foreign process.

My question is now: Who/What can read/write to this address in the foreign procces?

Is every process allowed to write?
Is every process allowed to read?
Do only have processes with admin rights the right to read/write?

Thanks for your answer.

Answer 1

Anyone with a process handle that grants read and write access can read or write the memory. See: PROCESS_VM_READ and PROCESS_VM_WRITE. So, ultimately, it depends on how you got the handle to the process and the DACL on that process.

You typically get all access if you created the process or if you have SeDebugPrivilege enabled. When you call OpenProcess, you have to specify which kinds of access you want, it that request is checked against the security descriptor for the process.