Skip to content

Require administrator permissions only when injecting.#17

Open
josago97 wants to merge 1 commit into
aevitas:masterfrom
josago97:master
Open

Require administrator permissions only when injecting.#17
josago97 wants to merge 1 commit into
aevitas:masterfrom
josago97:master

Conversation

@josago97

Copy link
Copy Markdown

The Process.EnterDebugMode call requires administrator privileges. These are not needed for basic memory read/write operations, but are required for code injection. Therefore, we only call it when injection is needed, allowing regular memory access without prompting the user for elevated permissions.

@aevitas

aevitas commented Jun 22, 2025

Copy link
Copy Markdown
Owner

Thanks for your submission!

There's a few things that come to mind when making these changes, in no specific order:

  1. Did you double check memory allocations still work with these changes?
  2. If I recall correctly, OpenProcess also requires administrator access if a process is opened with permissive permissions. I don't think it requires SeDebug privileges with the default flags, but since the flags are part of the constructor, anyone requesting more liberal permissions could be faced with problems.
  3. What would be the case for not having debug privileges?

There should be some tests in the project already, perhaps it would be good to add a few that cover these cases so we can make sure nothing seriously breaks.

@josago97

Copy link
Copy Markdown
Author
  1. There are some tests that use memory allocations. These tests continue to pass with this contribution.
  2. I've tried calling the native Windows API directly to check if administrator permissions were required, and indeed they are not. I've also tried other libraries, and administrator permissions are not required to read and write memory either. Perhaps they aren't required even for injection. It could be that if the process being read has been run with higher permissions, it's necessary to match those permissions to access its memory.
  3. If I want to manipulate the memory of a program like Notepad, I wouldn't need administrator permissions. So, why force the user to grant them?

Also, we would need to change the way we access process modules because the Process class caches the collection the first time it's read, and if a new module is opened, it won't appear. It would be more convenient to call the native Windows API to access the updated list.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants