How can I detect the memory data changed?

问题:

I am studying about the windows programming, and i have some question.

I saw a security module that defends memory data. if one process is going to change other process memory, it detects and turns off the process.

This is often used in anti-cheat engines in games or bank application programs(i live in Korea, so i think this is the best example of this. Almost every on-line games or bank application has self-defence algorithm.)

My question is, is there any APIs or functions that detects about this?

thanks.

P.S. i can make an example,

if 0x01000000 memory data is 'A', some different process changed it to 'B'. when i first thought about this, i thought that i have to make a thread to check the data and if it changes, turn off the process. but i think this is not a good idea. any suggestions?

回答1:

General answer to your question: no, there are no such API or functions.

But there are different methods where you can achieve same result. 1. Api hooking. You can Hook functions in system (such as WriteProcessMemory) and then check if somebody trying to change something in your process. More on this here. 2. Debugging. You can use debugging breakpoints on functions or memory change.