Pinned Repositories
BlackHat-EU-2019
This is the Online repository for the Black Hat EU 2019 Talk: Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries.
BlackHat-USA-2019
BlackHat-USA-2020
DFRWS-USA-2019
gunziper
Burp Suite extension
Hashtest
Validate integrity of in memory code
Process-Hollowing
Fork of m0n0ph1/Process-Hollowing with some modifications
ReflectiveDLLInjection
Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.
rekall-plugins
volatility-plugins
f-block's Repositories
f-block/volatility-plugins
f-block/BlackHat-USA-2020
f-block/DFRWS-USA-2019
f-block/Process-Hollowing
Fork of m0n0ph1/Process-Hollowing with some modifications
f-block/gunziper
Burp Suite extension
f-block/BlackHat-EU-2019
This is the Online repository for the Black Hat EU 2019 Talk: Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries.
f-block/rekall-plugins
f-block/BlackHat-USA-2019
f-block/Hashtest
Validate integrity of in memory code
f-block/ReflectiveDLLInjection
Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.
f-block/ConventionEngine
ConventionEngine - A Yara Rulepack for PDB Path Hunting
f-block/DFRWS-USA-2017
f-block/DFRWS-USA-2020
f-block/DFRWS-USA-2023
Additional material for the DFRWS USA 2023 submission "Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files"
f-block/HollowFind
Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect and divert the forensic analysis techniques. The plugin detects such attacks by finding discrepancy in the VAD and PEB, it also disassembles the address of entry point to detect any redirection attempts and also reports any suspicious memory regions which should help in detecting any injected code.
f-block/insinuator-snippets
A collection of code snippets used in blog posts.
f-block/rekall
Rekall Memory Forensic Framework
f-block/rekall-profiles
Public Profile Repository for Rekall Memory Forensic.
f-block/sigma
Generic Signature Format for SIEM Systems
f-block/velociraptor-docs
Documentation site for Velociraptor
f-block/volatility3
Volatility 3.0 development
f-block/xssValidator
This is a burp intruder extender that is designed for automation and validation of XSS vulnerabilities.
f-block/yara-rules