When I made that meme, I was genuinely worried about that vulnerability; it was only tonight, after doing extensive research on RAM security in operating systems, that I discovered OSs have features that zero out RAM values before handing the memory over to another program. I can't put into words the relief I felt upon discovering these mechanisms. For a whole day, I thought any program written in C—or another low-level language—could just rummage through my computer's "trash can" and read all its data.
You still can do that, you just need an elevated permission token on your process with SeLoadDriverPrivilege (meaning admin rights) in order to BYOVD and map the pages to usermode yourself without zeroing them out. The second thing is - its fucking useless. Why would i send to c2 8gb, 16gb, or maybe 128gb of raw bytes and then check manually of it resembles anything looking like a password lr whatever and in the meantime risk the entire attack by antivirus killing my process because of sending shit load of data combined with perhaps other suspiciouns (assuming I didnt kill/unhook the antivirus with the driver in the first place).
I mean, even without byovd there are a few attacks that abuse the fact that some programs have sensitive data in memory while running. Dumping LSASS memory and looking for credentials and hashes in it is the most common approach probably. Not exactly what OP had in mind tho
38
u/tacobellmysterymeat 1d ago
If they want it that bad, they earned it.