Forest Global Training Partners

Cyber Risks · Cisco Talos

!jutsu mem Diff

Summary: Cisco Talos added a memory diffing function called memDiff to its byakugan tool, letting users compare a segment of memory against any buffer tracked with identBuf. The command takes type, size, value, and address arguments, and the differ reports actual versus expected bytes while storing bad characters and corrupted offsets.

Bottom line: The tool's bad-character detection rests on a simple heuristic: a modified byte seen later in the payload is treated as offset-based corruption, while a character missing entirely is assumed to be a bad character, an approach the author notes fails without sufficiently complex input.

Read the original at Cisco Talos ↗

Topics
Malware
Related