I'm trying to detect whether a loaded module is being patched at run-time by a malicious process. In this case the module is an EXE being run.
My detection scheme is as follows:
MODULEINFO mInfo;
GetModuleInformation(myProc, myInstance, &modInfo, sizeof(MODULEINFO));
//
char* hash1 = hashBytes(mInfo.lpBaseOfDll, mInfo.SizeOfImage);
//.....some time later
char* hash2 = hashBytes(mInfo.lpBaseOfDll, mInfo.SizeOfImage);
//
bool moduleIsModified = compareHashes(hash1, hash2); //false == we're patched!
This worked fine at first...hashes would be identical if no patches occurred, and I could detect my own patches (bytes within the module address space changed with VirtualProect/CopyMemory) successfully.
However, I discovered that if I put the following code between the generation of hash1/hash2, the hashes will no longer match:
//char* hash1 = ....
std::ifstream stream(pathToModule); //this causes hashes to no longer match???
//char* hash1 = ....
Why is the creation of a file stream to a module changing the pre-loaded bytes of the module? My assumption that the module would sit statically in memory after being loaded (assuming no malicious patches) is obviously incorrect...but why? Is there a specific area of a module's loaded bytes that are dynamic?