NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Code Injection Detection
Master detecting code injection in memory. Learn to identify process hollowing, DLL injection, and extract injected payloads using Volatility.
Room tasks
1What Is Code Injection and Why Does It Matter
2Common Injection Techniques
3Detecting Injection with Volatility (malfind)
4Guided Lab: Finding Injected Code in a Memory Image
Frequently Asked Questions
What is code injection?
Code injection runs malicious code inside another process, so it hides behind a trusted program. Common forms include DLL injection and process hollowing, where a legitimate process is replaced in memory.
How does the malfind plugin work?
Malfind looks for memory regions that are executable and not backed by a file on disk, which often indicates injected code. Analysts then dump and inspect those regions.
What does ldrmodules help find?
It compares loader lists to spot DLLs that are mapped but hidden from the normal module lists. This advanced Codelivly room is free and shows how to combine these plugins.