Re: Is it possible to read a SGA's memory architecture ?

From: Billy Verreynne <vslabs_at_onwe.co.za>
Date: Tue, 22 Oct 2002 08:00:11 +0200
Message-ID: <ap2piq$320$1@ctb-nnrp2.saix.net>

Vladimir M. Zakharychev wrote:

> How about ReadProcessMemory() and WriteProcessMemory() ? ;)

Ah.. never knew about them. But then the only debug calls I've ever used has been installing keyboard hooks. :-)

> Privileged
> calls, restricted to debugging tools and likes, but still if you can get
> your process running as LocalSystem, you can get into any other process'
> memory space and do whatever you like there.

I see it is win32s, win95 and winnt supported.. what happens on win95 kernels? I would assume that there the call has none of the winnt restrictions?

> Plus there's that Shatter technique that may be (or may be not) applicable
> to Oracle - this one doesn't require any advanced privileges if you can
> find a LocalSystem service that can interact with the desktop. You then
> use pretty innocent messages to get your code into target's memory space
> and execute it in that context...

Please expand on this...

--
Billy

Received on Tue Oct 22 2002 - 01:00:11 CDT