Created
January 24, 2017 03:42
-
-
Save dkrutsko/d6118638b0ef711b30bfcfe5b083d067 to your computer and use it in GitHub Desktop.
Detects whether the memory of your process has been scanned
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Link with psapi.lib | |
#define NOMINMAX | |
#define WIN32_LEAN_AND_MEAN | |
#include <Windows.h> | |
#include <Psapi.h> | |
int main (void) | |
{ | |
// Allocate some non-physically backed memory | |
auto address = VirtualAlloc (nullptr, 0x1000, | |
MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); | |
while (true) | |
{ | |
// Usually performed in some detection thread | |
PSAPI_WORKING_SET_EX_INFORMATION info = { 0 }; | |
info.VirtualAddress = address; | |
// Check if our non-physically backed memory is valid | |
auto result = QueryWorkingSetEx (GetCurrentProcess(), | |
&info, sizeof (PSAPI_WORKING_SET_EX_INFORMATION)); | |
// Shouldn't happen | |
if (result == FALSE) | |
return 1; | |
// Check if a scan was preformed | |
if (info.VirtualAttributes.Valid) | |
return 2; // Scan detected!! | |
Sleep (50); | |
} | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment