Push the Red Button

I've just released a technical report summarizing some work I did a couple years ago that explores how forensic memory analysis and virtual machine introspection are closely linked. Abstract : Virtual machine introspection (VMI) has formed the basis of a number of novel approaches to security in recent years. Although the isolation provided by a virtualized environment provides improved security, software that makes use of VMI must overcome the semantic gap, reconstructing high-level state information from low-level data sources such as physical memory. The digital forensics community has likewise grappled with semantic gap problems in the field of forensic memory analysis (FMA), which seeks to extract forensically relevant information from dumps of physical memory. In this paper, we will show that work done by the forensic community is directly applicable to the VMI problem, and that by providing an interface between the two worlds, the difficulty of developing new virtualization ...

It's been quite a while since I wrote any new blog posts. This isn't entirely because I've been lazy; rather, I've picked up and relocated to sunny (and often hot and humid) Atlanta, Georgia to start the PhD program at Georgia Tech . I'm going to be working on lots of cool stuff with the Georgia Tech Information Security Center . Now that I'm here and starting to get settled in, you can expect the blog posts to start up again. Particularly with the forthcoming release of Volatility 1.3, I'm going to have a lot of new plugins and functionality to blog about. As a teaser, here are some of the things I've got in the works: getsids.py -- get the SID (kind of like a user ID in unix) that owns each process moddump.py -- extract loaded kernel modules from memory unloaded_modules.py -- list recently unloaded kernel modules ssdt.py -- show the System Service Descriptor Table, along with the kernel module that owns the memory. This can be used to detect hookin...