Live Memory Attacks and Forensics

Presented at Disobey 2020, Feb. 15, 2020, 7:45 p.m. (60 minutes).

The PCILeech direct memory access attack toolkit has become the defacto standard for PCIe DMA attacks amongst researchers, red teamers, governments and game cheaters alike. We will demo how to take total control of still vulnerable systems with PCIe DMA code injection using affordable FPGA hardware.

MemProcFS - The Memory Process File System is memory forensics made super easy! Analyze memory dumps or live memory by clicking on files in a virtual file system using your favorite tools. Analyze and modify live memory using PCILeech PCIe hardware devices or even memory acquired from remote hosts - live over the network. MemProcFS is 100% open source memory forensics, blazingly fast and super easy to use!

Presenters:

• Ulf Frisk
  Ulf is a pentester by day, and a Security Researcher by night. He is the author of the PCILeech direct memory access attack toolkit and the Memory Process File System. He is interested in things low-level and primarily focuses on Memory Analysis and Direct Memory Access (DMA). Twitter: @UlfFrisk

Links:

• https://disobey.fi/2020/profile/live_memory_attacks
• https://www.youtube.com/watch?v=mca3rLsHuTA

Similar Presentations:

• ShmooCon X (2014) / ADD -- Complicating Memory Forensics Through Memory Disarray
• DEF CON 30 (2022) / PCILeech and MemProcFS Demo
• CactusCon 11 (2023) / Is Dead Memory Analysis Dead? Finding Infected Systems through Live Memory Analysis