Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries
summary
Demonstrates that common memory-forensic plugins (malfind, hashtest, psinfo) miss injected, executable code when page protections are manipulated per-page or pages are paged out; uses PTE and PFN analysis to enumerate actual executable pages and detect modified mapped-file pages; builds a Rekall plugin (u-ptnum / PTNUM) that finds 22 executable altered pages in tests and exposes paged-out hits that require a pagefile dump; shows the technique reliably finds injections malfind misses.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:02Code injection and hiding
- 3:47VAD structure issues
- 8:14Hiding code from plugins
- 12:25Rootkit paradox and executable search
- 15:17Page table entries for detection
- 18:24Code detection in stack example
- 20:47Reflective delayed injection detection
- 21:29Unloaded pages scenario
- 22:10Limitations and combined approach
- 23:52Summary and future plans
- 24:57Q&A
related talks
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
55mHiding PIN's Artifacts to Defeat Evasive Malware
28mFileless Attack - Detecting the Undetectable
41mUsing Microarchitectural Design to Break KASLR and More
49mProcess Injection Techniques - Gotta Catch Them All
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
32mExplore Adventures in the Underland: Forensic Techniques against Hackers