Is there anyway to hook/detour either of OpenProcess()
or ReadProcessMemory()
function calls to my own custom functions?
Without:
- kernel driver on Zw/NtOpenProcess, requires rootkit exploit or driver signing for deployment
- injecting .dll's in every process, spammy waste of resources and alerts many antivirus
I am trying to prevent other processes from getting a HANDLE
or reading the memory of a vector of PIDs.