Monitoring Native Execution in WoW64 Apps

Monitoring Native Execution in WoW64 Apps

Explore advanced techniques for monitoring native execution in WoW64 applications in this HITB Security Conference talk. Delve into the challenges of injecting 64-bit DLLs into WoW64 processes and hooking 64-bit APIs. Learn about novel injection methods, modifications to existing techniques, and solutions to overcome obstacles introduced by newer Windows versions. Gain insights into OS internals, reverse engineering, and exploit mitigations as presenters Yarden Shafir and Assaf Carlsbad share their research on enhancing security monitoring across all current Windows versions.