Skip to main content
Reverse Engineering

Return to Question

replaced http://reverseengineering.stackexchange.com/ with https://reverseengineering.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.

Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?

More specifically, are there any "fixed/likely" characteristics of injected code? For instance, from this questionthis question it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.

Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?

More specifically, are there any "fixed/likely" characteristics of injected code? For instance, from this question it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.

Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?

More specifically, are there any "fixed/likely" characteristics of injected code? For instance, from this question it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?

Tweeted twitter.com/#!/StackReverseEng/status/425073445693816832
Source Link
Benny
Benny
  • 828
  • 7
  • 18

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.

Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?

More specifically, are there any "fixed/likely" characteristics of injected code? For instance, from this question it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?