Weird-Machine Motivated Practical Page Table Shellcode & Finding Out What's Running..

[Aerosol]

Defcon

Killing the Rootkit! And how to find

everything running on your system!!!

• Rootkit/APT technique for hiding processes

– Unlink kernel structures “DKOM”

• New 64bit detection technique ! DC22 exclusive -

– System/Platform independent technique

– Linux/BSD/Windows/ARM64/ADM64

• Works by analyzing physical memory & properties of

MMU Virtual Memory system

Read More: https://www.defcon.org/images/defcon-22/dc-22-presentations/Macaulay/DEFCON-22-Shane-Macaulay-Weird-Machine-Motivated-Practical-Page-Table-Shellcode-UPDATED.pdf

( nu l-am mai vazut pe forum, daca am gresit categoria rog un moderator sa il mute...

Articol de nota 10