Hello,

I was wondering if there is any way to make a memory address (which is used by a certain application) read-only. By this I mean that I do not want this application to be able to alter or modify the value but only read it. Is this possible? If so, how?

EDIT: For example, let's say I would want to make the windows minesweeper's timer read-only so minesweeper cannot make it count. How could I achieve this? (preferably without altering minesweeper's code).

Thanks.

http://msdn2.microsoft.com/en-us/library/aa366899.aspx

Correct me if I am wrong.

Given your example, I think you approach is not going to work.
Let me explain: You indeed can change a page to be read-only, using the API that disavowed points to, perhaps some already made utility. For instance Olly can make a whole section read-only.
But, what do you gain with it? if and when the program tries to change the contents of a read-only page in memory, windows is going to generate a page fault. If your program (or your memory manipulation routine) does not have the code to handle the fault, the program will crash and close. I doubt that is what you wanted in the first place, right?

So I don't think making a page read-only, all by itself is a very viable solution. I doubt that the program will go its merry way if it fails to write and important piece of data in memory.

I'm assuming he would also provide an exception handler for it.

I never said VirtualProtectEx alone would work. I was just answerring his original question

Perkele01 ("http://www.woodmann.com/forum/member.php?u=17762"), I'd recommend injecting a Vectored Exception Handler to check for the offset being written to -- if it's not your target offset then let the write proceed and swallow the exception, otherwise swallow the exception and don't let the write proceed. Make sure to re-enable read-only access after you allow writes. BTW, this will probably slow down your program quite a bit.

Even better, understand what you mean by making memory "read-only". Actually, it also means "FREEZING" the memory, a trick employed by SO many of the game trainers.

I'd suggest you download a game trainer with source (so many of them around) and find out how it accesses the process -> searches for the relative memory -> and freezes the memory. Of course, game trainers freeze a small part of the memory, and you many hav to do this en masse, but you get the idea...

Have Phun

Now I'm curious about what you mean about "FREEZING"
My first thought is to have a process keep overwriting it constantly with the desired value. Is this what you're referring to?

yup, thats generally how trainers freeze memory contents
some also patch 1 memory area and knock out the code that
writes to the area.. which is a considerably better approach..