Paging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory
summary
Examines Windows 10 memory compression internals, detailing undocumented structures and algorithms used by the compressed memory system. Covers how those implementation details can be parsed and supported in forensic tools to analyze compressed memory on new Windows 10 builds.
AI-written summary · about
chapters (22)
- 0:00Start
- 30:38The Big Picture
- 33:33Structure Extraction Automation
- 34:40FLARE-EMU
- 36:28Automate This
- 38:19Field Offset Located
- 38:36Rinse & Repeat G
- 39:50Volatility & Rekall
- 40:21Plugin's Baby Steps
- 40:45volshell
- 41:07Transparent Translation
- 41:42modules
- 42:22driverscan
- 42:38hashdump
- 42:50Unlocked Data
- 43:01Malware Overview
- 43:56handles -p 5684 - mutant
- 45:06malfind -p 5684
- 45:43Server DLL Strings
- 46:04Payload Strings
- 46:37Enhanced Analysis
- 47:51FIREEYE FLARE
related talks
42mWindows 10 Segment Heap Internals
33mOver the Edge: Silently Owning Windows 10's Secure Browser
01h 03mInvestigating Malware Using Memory Forensics - A Practical Approach
40mCommSec D1 - The Life & Death of Kernel Object Abuse
51mWindows 10 Mitigation Improvements
32mIntroduction to Windows Kernel Mode Debugging
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
44mDebugging memory corruptions in C++