Use a hook function:
BOOL WINAPI hkReadProcessMemory( HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead)
{
if (GetCurrentProcess() == hProcess) {
// your process
}
return oReadProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead);
}
typedef for function:
typedef BOOL (WINAPI* _NtReadProcessMemory)( HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead);
declare old function:
_NtReadProcessMemory oReadProcessMemory = (_NtReadProcessMemory)
GetProcAddress(GetModuleHandle(L"ntdll"), "NtReadProcessMemory");
install detour:
BOOL bHook = Mhook_SetHook((PVOID*)&oReadProcessMemory,
hkReadProcessMemory));
Obviously you'll need to inject this DLL into all processes running on the system.
Mhook: (detour library) http://codefromthe70s.org/mhook22.aspx