Question

It looks like it’s impossible to prevent determined attackers from modifying one’s process code/data. I’m hoping that its at least possible to detect such tampering.

Under Windows, is it possible to listen for DLL injections, WriteProcessMemory and CreateRemoteThread into the current process?

Under Linux, is it possible to listen for LD_PRELOAD and the DR rootkit?

Answer 1

with some really involved code you could be able to detect those…
It all depends on how determined the attacker is… IF they are really determined then they would use some rootkit approach – in that case your app can do nothing about it (no detection, no stopping as long as the attackers know what they are doing)…

another approach could be to try to do some hashing of your segments in memory while running but that would account for some snake oil since the hashing code itself would present an entry point to circumvent this method.

Executing your code inside a self-built VM which in turn communicates with the rest of the system through a hypervisor… the hypervisor has to be made the boot loader for the system of course so that the OS is just a “child” of your hypervisor… should do the trick…although you would have to write all that yourself and make sure it has no exploitable weakness (pretty sure noone can do that for such a complex piece of software)…

not sure what you are up against but as long as the HW+SW your code is running on is not directly under your full control there is always a way to do the things you mention and with a bit of planning avoid detection too…

OR is this “only” about protection from software piracy/reversing ?
IF so then there are some measures, even some 100% secure ones though it all is about balance of security versus usability…