search

forrest-orr / moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta
GNU General Public License v3.0
691 stars 82 forks source link

Use `MEMORY_WORKING_SET_EX_INFORMATION.SharedOriginal` to detect CoW regions on 1709+ #4

Closed gabriellandau closed 8 months ago

gabriellandau commented 9 months ago

It's possible to reset the MEMORY_WORKING_SET_EX_INFORMATION.Shared bit, hiding the fact that a memory region is CoW. Microsoft accounted for this when implementing module tampering protection. Moneta can easily do the same.

Example bypass: https://x.com/KlezVirus/status/1758428205285785698?s=20 That bypass doesn't defeat SharedOriginal: https://x.com/ilove2pwn_/status/1724176577506722150?s=20

Here is this branch (left) detecting a bypass that v1.0 (right) doesn't: image