An interesting news brief: apps can actually access other apps memory...

[mathieu...@gmail.com]

Will definitely add some credibility to our animation video:

http://tech.slashdot.org/story/14/08/22/2042213/researchers-hack-gmail-with-92-percent-success-rate

Cheers!

[Stefan Giroux]

http://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

ReadProcessMemory

If that fails, inject a dll (various methods) and read it from inside that process.


There should also be a way to get around NtProtectVirtualMemory
http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/memory%20management/virtual%20memory/ntprotectvirtualmemory.html

Either way, if you're running arbitrary code on a computer then you can get at a LOT of data.

[mathieu...@gmail.com]

Hey Stefan,

Thanks for the link!

Wouldn't this:

hProcess [in]

A handle to the process with memory that is being read. The handle must have PROCESS_VM_READ access to the process.

be the tricky part though?

--
You received this message because you are subscribed to the Google Groups "mooltipass" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mooltipass+...@googlegroups.com.
To post to this group, send email to moolt...@googlegroups.com.
Visit this group at http://groups.google.com/group/mooltipass.
For more options, visit https://groups.google.com/d/optout.

[Stefan Giroux]

Assuming I can post via reply like a mailing list:

That's not so tricky actually. In fact, I made a Left 4 dead 2 "external" cheat that resides entirely in a separate process and only passively reads the video game's memory. It was done in C# and amounts to the following:

ReadProcessMemory(Process.GetProcesses().SelectOne().Handle, addressToReadFrom, bufferToFill, sizeof(bufferToFill), &bytesRead);

In essence, critical memory should be treated carefully and proper practices like using SecureZeroMemory and anti-debugging techniques (unloading unknown DLLs, etc) can be implemented. If I get my hands on a Mooltipass in the future of course I'll try to break it :>


Best of luck w/ your funding campaign!

[mathieu...@gmail.com]

Very interesting... Have you tried your technique on keypass/lastpass?

Thanks!