Hi -

I would like to make certain regions of my application "read-only". I figured I could do this with VirtualProtect(), but what seems to happen is that using it renders the entire PAGE of memory read-only

Basically I would like to put guard-values around some buffers, and intercept the GPF if these guard-values are accessed -- does anyone know of a way to do this on Win32?

Thanks!

Hmmm... I guess the best solution would be read-only pages (iirc guard pages are NT-only), then write a SEH that traps GPF's, and checks whether the range is "protected", looks at the opcode that caused the GPF, etc... would probably be some good hours of work

how does it looks with using debugging register in ring3 under windoze? Maybe they could be used for such purpose...

That's apparently the only way, but I don't think you can write the debug registers in ring3 at all.

What I'm doing is using 'canary' values and checking them in an idle loop. This is probably good enough but it's wasteful and not as accurate as trapping a write.

You can write them easily, but I'm not sure whether in works on all versions of windows.

When you install exception handler via fs:[0] and raise an exception, you get access to CONTEXT structure in the handler, where you can overwrite probably all registers, including debug registers. You also rewrite the EIP to some safe place and resume the execution.

For more see
http://www.jorgon.freeserve.co.uk/ExceptFrame.htm

This method also use exe protectors to fool the debugger.

BTW, MOV from/to DRn registers is in ring3 normally prohibited, of course.

I have another question.. How can I FULLY protect some memory region so either write or read memory operations in this region will cause #GP?
And another one: how fast would be tracing app (doing nothing at debugger side, just stopping and resuming on every instruction) comparing to simple execution?

In ring 3 it takes approx from 2500 to 7000 tics to raise execution of ExeptionHandler with no user mode debugger active. It *depends* on hardware, OS, etc.
If debugger is active, then this time runs up. Here is some test with sources. And related discussion (in Russian)