https://insinuator.net/tags/hooking/ Recent content in Hooking on Insinuator.net - Bold Statements Hugo en-us Wed, 06 Sep 2023 00:00:00 +0000 https://insinuator.net/2023/09/identification-of-malicious-modifications-in-memory-mapped-image-files/ Wed, 06 Sep 2023 00:00:00 +0000 https://insinuator.net/2023/09/identification-of-malicious-modifications-in-memory-mapped-image-files/ <p>I’m happy to announce the publication of the paper <a href="https://dfrws.org/wp-content/uploads/2023/07/block-windowsmemoryforensics.pdf">Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files</a> at this years DFRWS USA, and the release of the corresponding <a href="https://github.com/f-block/volatility-plugins#imgmalfind">volatility plugin</a>. With this research came also an update to the Ptenum family (affecting especially the <code>ptemalfind</code> plugin), which makes the plugins reliable in identifying modified pages despite memory combining, so make sure to grab the newest version from the Github repository.</p>