How to hook memory I/O in windows kernel mode?

Asked Jun 20 '21 at 11:32

Active Jun 20 '21 at 11:32

Viewed 148 times

(English is not my native language; please excuse typing errors.)
I tried to monitor memory I/O on Windows. An apparent way is to poll some memory address like this:

while(true)
{
    ::ReadProcessMemory(...);
    if (changed)
        call back;
}

but that make some overhead. So I want to install a hook to monitor memory I/O(Maybe I need to write code in the ring0). But I can't find any information about that(on google, on msdn, etc.).
Can I do that? How to?

asked Jun 20 '21 at 11:32

lhgzbxhz

1

See https://stackoverflow.com/q/58851/1216776 – stark Jun 20 '21 at 12:50
@stark how does that have anything to do with Windows? – Marco Bonelli Jun 20 '21 at 13:20
@stark the watchpoint in gdb has 2 ways to implement: software watchpoint, like my example code; Hardware watchpoint, which using the debugging register.It's only for debugging. – lhgzbxhz Jun 25 '21 at 09:58

How to hook memory I/O in windows kernel mode?

0 Answers0