Recheck executable hash modification at runtime

120 Views Asked by At

For example, if I wrote an hello world program for example in C#, is there a way to check the running binary for modification at runtime?

We could read the .exe file (for example in Linux the /proc/PID/exe file), hash it, and compare the hash at runtime, that might works fine, but can we read the (self) running executable as bytes from memory and hash it to check if it's modified by something else at runtime?

0

There are 0 best solutions below