I have an interesting application that seems to crash whenever a particular region of memory is read using ReadProcessMemory. I know it's not doing anything special with RPM because:
- Injecting a DLL to read that region of memory directly also causes a crash.
- Scanning regions with applications like CheatEngine also causes a crash.
It's also not a guard region or a region with special protection flags. It's just a private R+W region.
At first I thought they were installing hardware data breakpoints like those described here, but after checking the debug registers of all threads and seeing that they were all zero made me conclude that another technique is used.
I suspect that they are somehow raising an exception whenever that piece of memory is read. I'm looking to understand what they're doing and how to detect it, or at the very least, make RPM not crash the application.
P.S. I cannot attach a debugger to this application, and the executable is encrypted, but I do know that various TLS callbacks are used along with VEH exception handlers.