|
Dumping protected memory?
Hi folks,
i have done a small loader which loads a process and changed the access
flags via VirtualProtectEx() but if i try to read memory of the loaded process
i got an error (can't remember which one). I know that some protections
set the NO_ACCESS or PAGE_GUARD flags on creation of memory so is there
a way to circumvent this? maybe with a kernel driver? or is there another
way under ring3?
thx for help
tr1stan
|