MoRE Shadow Walker - The Progression of TLB-Splitting on x86
Offered By: Black Hat via YouTube
Course Description
Overview
Explore the evolution of translation lookaside buffer (TLB) splitting for code hiding on x86 architecture in this 44-minute Black Hat conference talk. Gain insights into how Intel's Core i-series processors changed TLB architecture, rendering previous techniques obsolete. Learn about new research methods for TLB-splitting on modern hardware and their applications in both defensive and offensive cybersecurity. Discover how the EPT Shadow Walker rootkit leverages TLB-splitting to present different memory versions to defensive tools and the CPU, effectively concealing malicious code from anti-virus systems. Witness a demonstration of memory manipulation and hiding techniques, and examine the research results presented by Jacob Torrey.
Syllabus
MoRE Shadow Walker: The Progression of TLB-Splitting on x86
Taught by
Black Hat
Related Courses
Computer SecurityStanford University via Coursera Cryptography II
Stanford University via Coursera Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera Building an Information Risk Management Toolkit
University of Washington via Coursera Introduction to Cybersecurity
National Cybersecurity Institute at Excelsior College via Canvas Network