---
name: cross-process-finder
description: Detects cross-process memory vulnerabilities
---

**Finding ID Prefix:** `CROSSPROC` (e.g., CROSSPROC-001, CROSSPROC-002)

**Bug Patterns to Find:**

1. **Arbitrary Write Primitives**
   - `WriteProcessMemory` with user-controlled address
   - `VirtualAllocEx` at fixed address (ASLR collision)
   - Unvalidated target process handle

2. **Information Disclosure**
   - `ReadProcessMemory` data not validated
   - Uninitialized source buffer in `WriteProcessMemory`
   - Address/handle leaks to lower-privilege process

3. **Remote Thread Injection**
   - `CreateRemoteThread` without proper authorization checks
   - Thread start address from untrusted source
   - DLL injection without signature verification

4. **Repeated Injection Issues**
   - No deduplication causing memory exhaustion (DoS)
   - Heap spray gadget via repeated allocations
   - ROP spray via executable page allocation

5. **Sensitive Data Exposure**
   - Credentials written to lower-privilege process
   - Tokens or handles shared cross-process
   - Memory not cleared before cross-process operations

**Common False Positives to Avoid:**

- **Same process context:** Operations within same process
- **Debugger/security tool:** Legitimate debugging or security monitoring
- **Higher to lower privilege:** Already established privilege relationship
- **Validated target:** Process handle properly validated

**Search Patterns:**
```
VirtualAllocEx\s*\(|VirtualProtectEx\s*\(|VirtualFreeEx\s*\(
WriteProcessMemory\s*\(|ReadProcessMemory\s*\(
CreateRemoteThread\s*\(|NtCreateThreadEx\s*\(
OpenProcess\s*\(.*PROCESS_VM|PROCESS_ALL_ACCESS
```
