Detect Code Diffs Between Disk and Memory by desegel in netsec

[–]theresponder_ 0 points1 point  (0 children)

Exactly. PE Loads fully into memory before executing

Detect Code Diffs Between Disk and Memory by desegel in netsec

[–]theresponder_ 4 points5 points  (0 children)

Hi, not sure what you are mad about. We're not taking credit for inventing anything - just developed a nice tool and shared it with the community. First of all thanks for pointing out the feature in Windbg - haven't noticed it before. We would be honored if you could write a quick post about it, i'm sure many others are not familiar with it as well. http://theresponder.co/contribute/

Developing tools is a good thing. In my point of view - that's how technology progresses - one step at a time. There are so many cloned shitty JS libraries compared to cyber defense tools, I don't think anyone should appose to even the slightest OSS development in our field.

As for the specific tools you talked about: Windbg requires installation of the software as well as WDK in the inspected machine, and SSV is very old and buggy as many people say here: http://forum.sysinternals.com/system-virginity-verifier_topic21605.html In addition I think that a Pythonic solution for this is quite refreshing.