Contents

• Foreword
• Introduction
• Scanning Memory
  • Retrieving Pool Ranges
  • Locking Memory
  
  
• Detecting Executive Objects
  • Generic Object Information
  • Validating Pool Block Information
  • Object Specific Signatures
    • Process Objects
    • Thread Objects
    • Driver Objects
    • Device Objects
    • Miscellaneous
  
  
• Found An Object, Now What?
  • Process Objects
  • Thread Objects
  • Driver Objects
  • Device Objects
  
  
• Breaking Signatures
  • Pointer Based Signatures
  • N-Depth Pointer Validation
  • Miscellaneous
  
  
• GrepExec: The Tool
  • The Signature
  • Usage
  • Sample Output
  
  
• Conclusion
• Bibliography