RomHack 2025 - Denis Nagayuk (diversenok) - Attacking Assumptions Behind the Image Load Callbacks

Feature Overview

Denis Nagayuk (diversenok) of Hunt & Hackett examines Windows image-load notify routines used by Sysmon event 7, AV, and EDR tools to inspect DLL loads and enforce code-signing policies such as System Informer protections.

Callback Semantics

Drivers register via documented APIs receiving mapped image base, process ID, file name, and extended file-object pointers. Callbacks run synchronously after NtMapViewOfSection—post-operation—so images are visible to other threads while inspection runs; drivers cannot cancel loads cleanly without crashing callers.

Scope and Assumptions

The mechanism covers image-backed sections, not all executable private memory or data sections, which drives manual mapping evasion. Nagayuk formalizes OS and driver assumptions: files still exist, names remain queryable, and security products can open or hash images during callbacks.

Research Direction

He maps the file → file object → section → mapped image chain where mismatches create attack surface, aiming to violate those assumptions and show defenders where reliance on image-load callbacks breaks down.