Memory write watch anti-debug

[gsuberland]

Using VirtualAlloc's MEM_WRITE_WATCH and associated APIs to look for hooks and debuggers.

Writeup here:

https://codeinsecurity.wordpress.com/2018/01/24/anti-debug-with-virtualallocs-write-watch/

[gsuberland]

I'm aware that this isn't the best right now. I need to improve this at a later date, checking against better APIs and more of them, and using ResetWriteWatch instead of page access count deltas. For now this will suffice as a baseline.

[ayoubfaouzi]

I'm aware that this isn't the best right now. I need to improve this at a later date, checking against better APIs and more of them, and using ResetWriteWatch instead of page access count deltas. For now this will suffice as a baseline.

Make sense to me as well.

A new trick! thanks a lot again for your contribution, I never seen this one before, thank you so much for your blog article.

[gsuberland]

No probs. Yeah, I thought of this in the shower haha!