
memhunter
Live hunting of code injection techniques
defensive-toolsincident-responsemalware-analysis+1
384

Live hunting of code injection techniques

Linux Memory Cryptographic Keys Extractor

Ian Beer's exploit for CVE-2017-2370 (kernel memory r/w on iOS 10.2)

This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created,…