Difference between pages "User:RPD001" and "Memory analysis"
From Forensics Wiki
(Difference between pages)
m (Creating user page with biography of new user.) |
Joachim Metz (Talk | contribs) (→External Links) |
||
| Line 1: | Line 1: | ||
| − | + | '''Memory Analysis''' is the science of using a [[Memory Imaging|memory image]] to determine information about running programs, the [[operating system]], and the overall state of a computer. Because the analysis is highly dependent on the operating system, it has been divded into the following pages: | |
| − | + | ||
| − | + | * [[Windows Memory Analysis]] | |
| − | + | * [[Linux Memory Analysis]] | |
| + | |||
| + | == OS-Independent Analysis == | ||
| + | |||
| + | At the IEEE Security and Privacy conference in May 2011, Brendan Dolan-Gavitt presented a novel system, [http://www.cc.gatech.edu/~brendan/Virtuoso_Oakland.pdf Virtuoso], that was able to perform operating-system independent memory analysis. Using virtual machine introspection accompanied by a number of formal program analysis techniques, his system was able to monitor the machine-level instructions and behavior of application actions (listing processes, network connections, etc) and then automatically generate Volatility plugins that replicated this analysis. | ||
| + | |||
| + | == Encryption Keys == | ||
| + | |||
| + | Various types of encryption keys can be extracted during memory analysis. | ||
| + | * [[AESKeyFinder]] extracts 128-bit and 256-bit [[AES]] keys and [[RSAKeyFinder]] and private and public [[RSA]] keys from a memory dump [http://citp.princeton.edu/memory/code/]. | ||
| + | * [http://jessekornblum.com/tools/volatility/cryptoscan.py cryptoscan.py], which is a [[List of Volatility Plugins|plugin for the Volatility framework]], scans a memory image for [[TrueCrypt]] passphrases | ||
| + | |||
| + | == See Also == | ||
| + | |||
| + | * [[Memory Imaging]] | ||
| + | * [[:Tools:Memory Imaging|Memory Imaging Tools]] | ||
| + | * [[:Tools:Memory Analysis|Memory Analysis Tools]] | ||
| + | |||
| + | == External Links == | ||
| + | * [http://belkasoft.com/download/info/Live_RAM_Analysis_in_Digital_Forensics.pdf Discovering ephemeral evidence with Live RAM analysis] by Oleg Afonin and Yuri Gubanov, 2013 | ||
| + | * [http://cryptome.org/0003/RAMisKey.pdf RAM is Key - Extracting Disk Encryption Keys From Volatile Memory], by [[Brian Kaplan]], May 2007 | ||
| + | * [https://docs.google.com/presentation/d/1KsZGF6cQ-N8ngABFGCZf8pTQQ5CZ19VoAHq5cO5ZPdE/edit Memory Forensics With Volatility (Technology Preview)], by [[Michael Cohen]], October 2012 | ||
| + | * [http://www.dfrws.org/2013/proceedings/DFRWS2013-11.pdf An Evaluation Platform for Forensic Memory Acquisition Software] by Stefan Voemel and Johannes Stuettgen, DFRWS 2013 | ||
| + | |||
| + | === Computer architecture === | ||
| + | * [http://en.wikipedia.org/wiki/64-bit_computing Wikipedia: 64-bit computing] | ||
| + | * [http://www.unix.org/version2/whatsnew/lp64_wp.html 64-Bit Programming Models: Why LP64?], The Open Group, 1997 | ||
| + | |||
| + | === [http://volatility-labs.blogspot.com/ Volatility Labs] === | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-11-logon-sessions-processes-and.html MoVP 1.1 Logon Sessions, Processes, and Images] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-12-window-stations-and-clipboard.html MoVP 1.2 Window Stations and Clipboard Malware] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-13-desktops-heaps-and-ransomware.html MoVP 1.3 Desktops, Heaps, and Ransomware] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-14-average-coder-rootkit-bash.html MoVP 1.4 Average Coder Rootkit, Bash History, and Elevated Processes] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-15-kbeast-rootkit-detecting-hidden.html MoVP 1.5 KBeast Rootkit, Detecting Hidden Modules, and sysfs] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-21-atoms-new-mutex-classes-and-dll.html MoVP 2.1 Atoms (The New Mutex), Classes and DLL Injection] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-22-malware-in-your-windows.html MoVP 2.2 Malware In Your Windows] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-23-event-logs-and-service-sids.html MoVP 2.3 Event Logs and Service SIDs] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-24-analyzing-jynx-rootkit-and.html MoVP 2.4 Analyzing the Jynx rootkit and LD_PRELOAD] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-25-investigating-in-memory-network.html MoVP 2.5: Investigating In-Memory Network Data with Volatility] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/howto-scan-for-internet-cachehistory.html HowTo: Scan for Internet Cache/History and URLs] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-32-shellbags-in-memory-setregtime.html MoVP 3.2 Shellbags in Memory, SetRegTime, and TrueCrypt Volumes] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-33-analyzing-user-handles-and.html MoVP 3.3 Analyzing USER Handles and the Win32k.sys Gahti] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-34-recovering-tagclipdata-whats-in.html MoVP 3.4: Recovering tagCLIPDATA: What's In Your Clipboard?] | ||
| + | * [http://volatility-labs.blogspot.com/2012/09/movp-35-analyzing-2008-dfrws-challenge.html MoVP 3.5: Analyzing the 2008 DFRWS Challenge with Volatility] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/movp-41-detecting-malware-with-gdi.html MoVP 4.1 Detecting Malware with GDI Timers and Callbacks] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/movp-43-taking-screenshots-from-memory.html MoVP 4.2 Taking Screenshots from Memory Dumps] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/movp-43-recovering-master-boot-records.html MoVP 4.3 Recovering Master Boot Records (MBRs) from Memory] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/movp-44-cache-rules-everything-around.html MoVP 4.4 Cache Rules Everything Around Me(mory)] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-malware-in-windows-gui.html OMFW 2012: Malware In the Windows GUI Subsystem] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-reconstructing-mbr-and-mft.html OMFW 2012: Reconstructing the MBR and MFT from Memory] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/solving-grrcon-network-forensics.html Solving the GrrCon Network Forensics Challenge with Volatility] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-analyzing-linux-kernel.html OMFW 2012: Analyzing Linux Kernel Rootkits with Volatility] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-datalore-android-memory.html OMFW 2012: Datalore: Android Memory Analysis] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/movp-for-volatility-22-and-omfw-2012.html MoVP for Volatility 2.2 and OMFW 2012 Wrap-Up] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/reverse-engineering-poison-ivys.html Reverse Engineering Poison Ivy's Injected Code Fragments] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-analysis-of-process-token.html OMFW 2012: The Analysis of Process Token Privileges] | ||
| + | * [http://volatility-labs.blogspot.com/2012/10/omfw-2012-mining-pfn-database-for.html OMFW 2012: Mining the PFN Database for Malware Artifacts] | ||
| + | * [http://volatility-labs.blogspot.com/2014/01/truecrypt-master-key-extraction-and.html TrueCrypt Master Key Extraction And Volume Identification] | ||
| + | |||
| + | === Volatility Videos === | ||
| + | * [http://sketchymoose.blogspot.com/2011/10/set-up-to-more-memory-forensics.html Set Up to More Memory Forensics!], October 2011 | ||
| + | * [http://www.youtube.com/watch?v=8HsZLge0wWc Using Volatility: Suspicious Process (1/2)] | ||
| + | * [http://www.youtube.com/watch?v=XTZPNk-Esok Using Volatility: Suspicious Process (2/2)] | ||
| + | |||
| + | === WinDBG === | ||
| + | * [http://blog.opensecurityresearch.com/2013/12/getting-started-with-windbg-part-1.html Getting Started with WinDBG - Part 1], by Brad Antoniewicz, December 17, 2013 | ||
| + | * [http://blog.opensecurityresearch.com/2013/12/getting-started-with-windbg-part-2.html Getting Started with WinDBG - Part 2], by Brad Antoniewicz, December 24, 2013 | ||
| + | * [http://blog.opensecurityresearch.com/2013/12/getting-started-with-windbg-part-3.html Getting Started with WinDBG - Part 3], by Brad Antoniewicz, December 31, 2013 | ||
| + | |||
| + | [[Category:Memory Analysis]] | ||
Revision as of 15:00, 14 January 2014
Memory Analysis is the science of using a memory image to determine information about running programs, the operating system, and the overall state of a computer. Because the analysis is highly dependent on the operating system, it has been divded into the following pages:
Contents |
OS-Independent Analysis
At the IEEE Security and Privacy conference in May 2011, Brendan Dolan-Gavitt presented a novel system, Virtuoso, that was able to perform operating-system independent memory analysis. Using virtual machine introspection accompanied by a number of formal program analysis techniques, his system was able to monitor the machine-level instructions and behavior of application actions (listing processes, network connections, etc) and then automatically generate Volatility plugins that replicated this analysis.
Encryption Keys
Various types of encryption keys can be extracted during memory analysis.
- AESKeyFinder extracts 128-bit and 256-bit AES keys and RSAKeyFinder and private and public RSA keys from a memory dump [1].
- cryptoscan.py, which is a plugin for the Volatility framework, scans a memory image for TrueCrypt passphrases
See Also
External Links
- Discovering ephemeral evidence with Live RAM analysis by Oleg Afonin and Yuri Gubanov, 2013
- RAM is Key - Extracting Disk Encryption Keys From Volatile Memory, by Brian Kaplan, May 2007
- Memory Forensics With Volatility (Technology Preview), by Michael Cohen, October 2012
- An Evaluation Platform for Forensic Memory Acquisition Software by Stefan Voemel and Johannes Stuettgen, DFRWS 2013
Computer architecture
- Wikipedia: 64-bit computing
- 64-Bit Programming Models: Why LP64?, The Open Group, 1997
Volatility Labs
- MoVP 1.1 Logon Sessions, Processes, and Images
- MoVP 1.2 Window Stations and Clipboard Malware
- MoVP 1.3 Desktops, Heaps, and Ransomware
- MoVP 1.4 Average Coder Rootkit, Bash History, and Elevated Processes
- MoVP 1.5 KBeast Rootkit, Detecting Hidden Modules, and sysfs
- MoVP 2.1 Atoms (The New Mutex), Classes and DLL Injection
- MoVP 2.2 Malware In Your Windows
- MoVP 2.3 Event Logs and Service SIDs
- MoVP 2.4 Analyzing the Jynx rootkit and LD_PRELOAD
- MoVP 2.5: Investigating In-Memory Network Data with Volatility
- MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem
- HowTo: Scan for Internet Cache/History and URLs
- MoVP 3.2 Shellbags in Memory, SetRegTime, and TrueCrypt Volumes
- MoVP 3.3 Analyzing USER Handles and the Win32k.sys Gahti
- MoVP 3.4: Recovering tagCLIPDATA: What's In Your Clipboard?
- MoVP 3.5: Analyzing the 2008 DFRWS Challenge with Volatility
- MoVP 4.1 Detecting Malware with GDI Timers and Callbacks
- MoVP 4.2 Taking Screenshots from Memory Dumps
- MoVP 4.3 Recovering Master Boot Records (MBRs) from Memory
- MoVP 4.4 Cache Rules Everything Around Me(mory)
- OMFW 2012: Malware In the Windows GUI Subsystem
- OMFW 2012: Reconstructing the MBR and MFT from Memory
- Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit
- Solving the GrrCon Network Forensics Challenge with Volatility
- OMFW 2012: Analyzing Linux Kernel Rootkits with Volatility
- OMFW 2012: Datalore: Android Memory Analysis
- MoVP for Volatility 2.2 and OMFW 2012 Wrap-Up
- Reverse Engineering Poison Ivy's Injected Code Fragments
- OMFW 2012: The Analysis of Process Token Privileges
- OMFW 2012: Mining the PFN Database for Malware Artifacts
- TrueCrypt Master Key Extraction And Volume Identification
Volatility Videos
- Set Up to More Memory Forensics!, October 2011
- Using Volatility: Suspicious Process (1/2)
- Using Volatility: Suspicious Process (2/2)
WinDBG
- Getting Started with WinDBG - Part 1, by Brad Antoniewicz, December 17, 2013
- Getting Started with WinDBG - Part 2, by Brad Antoniewicz, December 24, 2013
- Getting Started with WinDBG - Part 3, by Brad Antoniewicz, December 31, 2013
