Linux Memory Forensics: Dissecting the User Space Process Heap

Please always quote using this URN: urn:nbn:de:bvb:29-opus4-83405
  • The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use the Glibc heapThe analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use the Glibc heap implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside. We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information. Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes: Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation. These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process. The remaining two plugins are a result of these user space process analyses and are extracting the command history for the zsh shell and password entry information for the password manager KeePassX.show moreshow less

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar Statistics
Metadaten
Author:Frank Block, Andreas Dewald
Persistent identifiers - URN:urn:nbn:de:bvb:29-opus4-83405
ISSN:2191-5008
Series (Volume number):Technical reports / Department Informatik (CS-2017-02)
Document Type:Report
Language:English
Year of publication:2017
Date of online publication (Embargo Date):2017/04/10
Publishing Institution:Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Participating institution:ERNW Research GmbH
Release Date:2017/04/12
Tag:Memory Forensics, Digital Forensics, Linux, Heap
SWD-Keyword:Computerforensik
Volume/year:2017
Issue:April
Length/size:66
Institutes:Technische Fakultät
CCS-Classification:C. Computer Systems Organization
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 006 Spezielle Computerverfahren
MSC-Classification:00-XX GENERAL
PACS-Classification:00.00.00 GENERAL
open_access (DINI-Set):open_access
Licence (German):Creative Commons - CC BY - Namensnennung 3.0
Einverstanden ✔
Diese Webseite verwendet technisch erforderliche Session-Cookies. Durch die weitere Nutzung der Webseite stimmen Sie diesem zu. Unsere Datenschutzerklärung finden Sie hier.