763 Followers
286 Following
49 Posts
IT-Security Minion | DMA Hacker | http://github.com/ufrisk | twitter.com/UlfFrisk | PCILeech | MemProcFS
Githubhttps://github.com/ufrisk
Twitterhttps://twitter.com/UlfFrisk
Bloghttps://blog.frizk.net
DiscordUlfFrisk#5780

Donated to the PCILeech project today.

It is amazing how easy dma stuff is now. And how cheap. I tooted some appreciaation earlier in the week, but this afternoon I had some first success against an actual research target. The victim does a pretty good job of locking things down, but DMA attacks are really fun when they work.

Thanks to @UlfFrisk, and of course to the videogame cheating community (like 99.5% of the tutorials on flashing and using pcileech have "setting up your aimboat" as the last step, lulz).

I'm not a gamer, but I kinda appreciate that there is a weird community of people doing DMA attacks in order to 'win' at shooters or whatever. They certainly make the hardware cost a lot less...

PCILeech PCIe DMA attacks and MemProcFS memory forensics now runs on macOS analyzing Windows memory!

MemProcFS 5.14 and PCILeech 4.19 just released!
https://github.com/ufrisk/MemProcFS
https://github.com/ufrisk/pcileech

MemProcFS 5.13 released!

Callstack parsing, improved file recovery and more! MemProcFS - easy and fast memory forensics! https://github.com/ufrisk/MemProcFS

GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub

Improvements to MemProcFS forensic file recovery in 5.12.6. More data is now recovered, with correct file sizes, and with file signing info!

MemProcFS super fast memory forensics and analysis: https://github.com/ufrisk/MemProcFS

GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub

MemProcFS now supports console text recovery!

Recover text from Cmd and Powershell to Find Evil with MemProcFS super fast memory forensics!

https://github.com/ufrisk/MemProcFS

GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub

MemProcFS 5.10 released! Support for Windows 11 24H2 added!

MemProcFS - super fast memory forensics of live memory and memory dumps!
https://github.com/ufrisk/MemProcFS

GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub

microsoft: Exploit Code Unporoven

me: i literally gave you a compiled PoC and also exploit code

m$: No exploit code is available, or an exploit is theoretical.

me:

Added a quick system overview to MemProcFS memory forensics. Check out one place for a summary rather than many locations as before.
https://github.com/ufrisk/MemProcFS
GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub

Still work in progress, but 64-bit Win10 & Win11 works well. If able to, it's recommended to use together with the pagefile.

@k1nd0ne excellent blog entry is found here: https://www.forensicxlab.com/posts/hibernation/

πŸ“˜ Volatility3: Modern Windows Hibernation file analysis

Abstract Link to heading In the Digital Forensics ecosystem, the field of memory forensics can help uncover artifacts that can’t be found anywhere else. That can include deleted files, network connections, running processes, rootkits, code injection, fileless malware and many more. Microsoft introduced the hibernation feature in Windows 2000, allowing systems to be powered down while preserving their volatile state. This is achieved by saving RAM contents and processor context to a file called hiberfil.

MemProcFS memory forensics now supports Windows Hibernation Files!

Thank You @k1nd0ne for your excellent blog entry about the file format!

https://github.com/ufrisk/MemProcFS

GitHub - ufrisk/MemProcFS: MemProcFS

MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

GitHub