4

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate to find information about how these tools (eg Volatility) are actually working in theory. For example, how they identify offsets, processes, connections, differences in memory depending on the OS by looking at the raw dump or any other way.

How do memory analysis tools work? What method do they use? I can't seem to find much information about this.

Improve this question
0

1 Answer 1

Reset to default
4

A lot of analysis tools look for known data structures (i.e., patterns) in memory that indicate a particular type of information.

For instance, malloc'd memory has header (and sometimes trailer) data that point forward and backward in memory to adjacent memory. Free'd memory pointers can jump around in memory if they aren't consolidated/coalesced.

Windows C++ applications have the notion of classes and a "this" pointer, which points to a class. The structure of C++ classes is known, so when one of these pointers is found a lot of information about the class can be derived. If it is a known class/data-type then it can be parsed relatively easily.

File's open in memory can be discovered by their "file signatures" (usually the first 3 or so bytes of the file). If those are found, some quick analysis can be done to determine if it's actually a legitimate file of that type or if it was dumb luck that those bytes occurred.

So, in general, many memory analysis tools look for known patterns in memory and/or hook into key datastructures within the kernel and then parse memory from there. Once you find code areas, you can "disassemble" them and find references (pointers) to other regions of memory. And following those you can find other data structures.

I hope that helps some.

Improve this answer
1
  • 1
    Good answer. I would add that memory analysis is similar to the action of a debugger or reverse engineering tool. It's a lot of work to catalog all the different compilers, libraries, and how they all produce code, and building this knowledge is expensive. They tend to hold onto this as their "secret sauce", so user3127632 may not find too much more info on the details.
    – John Deters
    Jul 28, 2014 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .