Problem - Kevin Tafuro

eturn dst;
}
volatile void *spc_memmove(volatile void *dst, volatile void *src, size_t len) {
size_t i;
volatile char *cdst, *csrc;
cdst = (volatile char *)dst;
csrc = (volatile char *)src;
if (csrc > cdst && csrc < cdst + len)
for (i = 0; i < len; i++) cdst[i] = csrc[i];
else
while (len--) cdst[len] = csrc[len];
return dst;
}
If you’re writing code for Windows using the latest Platform SDK, you can use
SecureZeroMemory( ) instead of spc_memset( ) to zero memory. SecureZeroMemory( ) is
actually implemented as a macro to RtlSecureMemory( ), which is implemented as an
inline function in the same way that spc_memset( ) is implemented, except that it only
allows a buffer to be filled with zero bytes instead of a value of the caller’s choosing
as spc_memset( ) does.
13.3 Preventing Memory from Being Paged to
Disk
Problem
Your program stores sensitive data in memory, and you want to prevent that data
from ever being written to disk.
Solution
On Unix systems, the mlock( ) system call is often implemented in such a way that
locked memory is never swapped to disk; however, the system call does not necessarily
guarantee this behavior. On Windows, VirtualLock( ) can be used to achieve the
desired behavior; locked memory will never be swapped to disk.
Discussion
The solutions presented here are not foolproof methods. Given
enough time and resources, someone will eventually be able to extract
the data from the program’s memory. The best you can hope for is to
make it so difficult to do that an attacker deems it not worth the time.
Preventing Memory from Being Paged to Disk | 707
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.