New answers tagged memory
Each block of the output of PBKDF2 is derived independently of all the other blocks. Because of this, computing a large output on a massively parallel system (such as a GPU) is very efficient. Further, if you only take certain bytes of the output and discard the rest, an attacker only needs to compute the blocks containing those bytes.
We can't "also make PBKDF2 use a lot of memory by simply asking it for a large output (and taking the bytes we actually need from the end of output, discarding the rest)" because PBKDF2 can essentially stream its output.
The answer all depends on the rootkit and how it operated. There WILL BE remnants, but whether they are visible, encrypted, mangled, etc., are another story. Since you have a memory image, you can analyze it with Volatility, carve out data from the dmp with psdispscan if you can detect the anomaly from the memory. You could also use scalpel to do this but ...
Top 50 recent answers are included