I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The catch is that our solution has to be stealthy and undetected by the kernel, so no DMA, drivers or anything that invokes traditional system calls/routines. Anything that leverages the kernel can be detected by the kernel.
Assume the system in question is infected by a rootkit. Assume the rootkit is employing everything specified here and more unknown anti-debug routines: https://github.com/LordNoteworthy/al-khaser So all the traditional windows routines, (like ObRegisterCallbacks) are hooked.
Is there a digital forensic device for this use case? In so far as I can tell the conventional means of volatile memory collection for forensic purposes can be detected (scraping/dumping).
Note1: There is a "magic" number associated with the bytes surrounding the key, so we don't have to worry about being overwhelmed by heaps of data, we can filter for those magic bytes.
Note2: We can in theory configure this to use non volatile memory for RAM... then shutoff the computer while the key is in there. However, the key is only good as long as the process remains open. It is random gen, key cannot be cracked. This is also somewhat of a side-channel attack question I suppose. Reading cache I would assume be out of the question since its usually embedded on the cpu or motherboard.
Note3: Running this in a hypervisor might be the call. But there still exists the extra hurdles of avoiding detection of sandboxing. Would rather use a solution that avoids virtualization.
Note4: I originally asked this in EE section about using some type of logic analyzer to read the key as it was coming over the PCI-e bus, but that would disrupt some of the data coming over (resistance and properties of impedance would be disrupted).