...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Digital investigation >Linux memory forensics: Dissecting the user space process heap
【24h】

Linux memory forensics: Dissecting the user space process heap

机译：Linux内存取证：剖析用户空间进程堆

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use this implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside. We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information. Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes: Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation. These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process. The remaining two plugins are a result of these user space process analyses and are extracting the command history for the zsh shell and password entry information for the password manager KeePassX. (C) 2017 The Author(s). Published by Elsevier Ltd. on behalf of DFRWS.
机译：法医调查期间的记忆分析通常是重建事件的重要步骤。尽管该领域的先前工作主要集中在内核空间（进程列表，网络连接等）中的信息，尤其是在Microsoft Windows操作系统上，但此工作着重于Linux用户空间进程，因为它们可能还包含有价值的调查信息。由于堆中有很多进程数据，因此首先要做的工作是分析Glibc的堆实现，以及与堆有关的信息在使用该实现的Linux进程的虚拟内存中的存储方式和存储方式。到目前为止，从内存取证的角度来看，堆通常被认为是一个较大的内聚内存区域，这使得识别内部相关信息变得相当困难。我们为内存分析框架Rekall引入了一个Python类，该类基于我们的分析结果，并允许访问堆中包含的所有块及其元信息。此外，基于该类，已经开发了六个插件来支持研究人员分析用户空间过程：这些插件中的四个提供了通用的分析功能，例如在块中查找信息/引用以及将块转储到单独的文件中以供进一步研究。这些插件已用于在用户空间进程中对堆中的数据结构进行反向工程，同时说明了此类插件如何简化整个分析过程。剩下的两个插件是这些用户空间过程分析的结果，并正在提取zsh shell的命令历史记录和密码管理器KeePassX的密码输入信息。 （C）2017作者。由Elsevier Ltd.代表DFRWS发布。

著录项

  • 来源
    《Digital investigation》 |2017年第8期|S66-S75|共10页
  • 作者

    Block Frank; Dewald Andreas;

  • 作者单位

    ERNW GmbH, Heidelberg, Germany|Friedrich Alexander Univ Erlangen Nuremberg FAU, Erlangen, Germany;

    ERNW Res GmbH, Heidelberg, Germany|Friedrich Alexander Univ Erlangen Nuremberg FAU, Erlangen, Germany;

  • 收录信息
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

    Linux; Heap; Memory forensics; Glibc; Rekall;

    机译：Linux;堆;内存取证;Glibc;Rekall;

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号