Hey all,
I'm using Windows 8 64 bit. I know C++ and basics of assembly. My goal is to get dumped .exe of a game from its process's memory. So, I wrote a program which is able to successfuly read memory from most of processes using VirtualQueryEx. However, I've come across a process for which this function fails. It's not a system process, just a game process. Without Debug privileges I couldn't even open the process's handle(OpenProcess). With them I am able to get the process's handle but still get access denied for VirtualQueryEx.
Why is that happening? Does anybody know what did they do to deny access to memory for other applications even with debug privileges set?
Now, I've already done a lot of research and wonder which approach should I follow in order to reach my goal. Is that possible that I can read this process's memory only in kernel mode? It seems to be a lot of work and in kernel mode there is no functions such as VirtualQueryEx etc...
I've read also that VirtualQueryEx might be hooked or sth? If that's the case what could I do to unhook this?
Or maybe, simple DLL injection could work? Provided that DLL can be attached without access denied... Then inside my DLL I would be within Virtual address space for the game's process and getting it's binary shouldn't be a probem then. I haven't tried it yet though.
I hope some professional could answer my questions and point me to the right direction! I would be really grateful for any help in this matter!