From Dead Data to Digestion: Extracting Windows Fibers for Your Digital Forensics Diet
summary
Reverse engineers Windows fiber internals, finds fiber objects allocated as 0x530 allocation size on the heap and no thread ID in the object, uses the undocumented FLS linked list to associate dormant fibers with creating thread IDs (FLS linked list association), reverse engineers the FLS value lookup (hard cap 4079) and extracts callbacks and FLS slots, builds and open-sources an automation called Weetabix JSON output that locates RWE/unbacked fiber code and flags Cobalt Strike stack‑spoofing artifacts; testing shows it reliably surfaces malicious callbacks and anomalous fiber telemetry.
AI-written summary · about
chapters (15)
- 0:00Introduction to Windows fibers
- 3:44Fiber architecture
- 4:27Fiber API and usage
- 5:42Threats and detection gaps
- 10:14Research methodology
- 11:33Identifying fibers in memory
- 13:31Analyzing fiber objects
- 14:53Mapping dormant fibers
- 17:31Fiber local storage
- 17:48Enumerating storage indexes
- 19:29Extracting callback info
- 19:50Consolidating telemetry
- 20:57Implementing detections
- 21:17Weetabix and conclusions
- 26:59Closing remarks
related talks
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
14mDFIR - Don't Forget Your Roots!
46mDigital Forensics – The Importance of Forensic Triage Images
10mBacktraces in the mirror: mad science by secrets of elves & dwarves!!
30mThe Next Generation of Windows Exploitation: Attacking the Common Log File System
46mFor The Win: The Art Of The Windows Kernel Fuzzing
51mAutomation Techniques in C++ Reverse Engineering