ReadProcessMemory() detectable by Ring3?

[SailorMars]

Just a general technical question, but most likely applicable to wow.
is it possible for a ring3 AC knows some other processes are doing ReadProcessMemory() on its client process?

2 techniques I heard of: a) trap pages as used in wow/OW, b) hooking the suspicious process's ReadProcessMemory() directly (nProtect Gameguard?). Apart from these, are there any other possibilities?

[DrD]

Yes, there are many ways they could detect you.

They could hook NtReadVirtualMemory, or just enumerate all handles and the access they have to the wow process, for example.

Now just having an open handle isn't immediate grounds for a ban, but it could trigger a closer inspection by other scans to the process opening the handle.

[SailorMars]

Yes, there are many ways they could detect you.

They could hook NtReadVirtualMemory, or just enumerate all handles and the access they have to the wow process, for example.

Now just having an open handle isn't immediate grounds for a ban, but it could trigger a closer inspection by other scans to the process opening the handle.

Is it possible to hook NtReadVirtualMemory() with patch guard running?

[pogob]

Is it possible to hook NtReadVirtualMemory() with patch guard running?

Wait, is it possible for you to hook it? Or if it's possible for them to hook it? The answer to both these questions, for WoW at least, is yes (and I doubt OW is different). But WoW doesn't hook NtRVM on live at least.

[Sen66]

I guess @SailorMars meant kernelmode. In kernel you cant hook it with patchguard running. But there are opther ways to intercept syscalls such as NtXXXVirtualMemory, there is no need to hook.

[Jadd]

Just execute the syscall yourself if you're this paranoid. Keep in mind that you also need an open handle to the game for reading and Blizzard can see these from Ring3.

Blackbone/src/BlackBone/Syscalls at master . DarthTon/Blackbone . GitHub

[Seifer]

Just execute the syscall yourself if you're this paranoid. Keep in mind that you also need an open handle to the game for reading and Blizzard can see these from Ring3.

Blackbone/src/BlackBone/Syscalls at master . DarthTon/Blackbone . GitHub

Doesn't matter much - they usually do a bunch more stuff before flagging you as a "bad" program. You shouldn't get into trouble for just having a handle open to the process afaik.