Skip to content

Conversation

@josago97
Copy link

The Process.EnterDebugMode call requires administrator privileges. These are not needed for basic memory read/write operations, but are required for code injection. Therefore, we only call it when injection is needed, allowing regular memory access without prompting the user for elevated permissions.

@aevitas
Copy link
Owner

aevitas commented Jun 22, 2025

Thanks for your submission!

There's a few things that come to mind when making these changes, in no specific order:

  1. Did you double check memory allocations still work with these changes?
  2. If I recall correctly, OpenProcess also requires administrator access if a process is opened with permissive permissions. I don't think it requires SeDebug privileges with the default flags, but since the flags are part of the constructor, anyone requesting more liberal permissions could be faced with problems.
  3. What would be the case for not having debug privileges?

There should be some tests in the project already, perhaps it would be good to add a few that cover these cases so we can make sure nothing seriously breaks.

@josago97
Copy link
Author

  1. There are some tests that use memory allocations. These tests continue to pass with this contribution.
  2. I've tried calling the native Windows API directly to check if administrator permissions were required, and indeed they are not. I've also tried other libraries, and administrator permissions are not required to read and write memory either. Perhaps they aren't required even for injection. It could be that if the process being read has been run with higher permissions, it's necessary to match those permissions to access its memory.
  3. If I want to manipulate the memory of a program like Notepad, I wouldn't need administrator permissions. So, why force the user to grant them?

Also, we would need to change the way we access process modules because the Process class caches the collection the first time it's read, and if a new module is opened, it won't appear. It would be more convenient to call the native Windows API to access the updated list.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants