Cyber Risks · Cisco Talos

Update to byakugan’s ident Buf and mem Diff functionality

Summary: Cisco Talos updated the byakugan tool's identBuf and memDiff functionality to allow files to be imported into tracked buffers and used as a memDiff input type. The !jutsu identBuf command now takes the format TYPE NAME [VALUE SIZE], supporting ascii, msfpattern (now with a custom name), and file types, with all binaries updated.

What you should know: The change lets analysts register a file of any format as a tracked buffer and feed it directly into memDiff, extending the tool's memory comparison work beyond ASCII strings and pattern buffers.

Read the original at Cisco Talos ↗

Topics
Malware
Related