Re: [Vol-users] 29c3 defeating windows memory forensics

Moonsols Community Edition appears to support a "/s" option which will generate a cryptographic checksum which may be compared to the actual checksum of the output file. While it is true, as you say, that cryptographic checksums will not detect tampering which occurred prior to the checksum's creation, adding the "/s" option should detect all of the kernel mode attacks which you document. It will force you to attack along the read path (NtMapViewOfSection, MmMapIoSpace and MmMapMemoryDumpMdl) or else to fake both the content and the checksum. I am assuming that Matthieu is generating the checksum before writing the data to disk and not from the output file after it has been written. +1 for Matthieu (maybe).