In the Land of MMUs: Multiarchitecture OS-Agnostic Virtual Memory Forensics - Archive ouverte HAL Access content directly
Journal Articles ACM Transactions on Privacy and Security Year : 2022

In the Land of MMUs: Multiarchitecture OS-Agnostic Virtual Memory Forensics

Andrea Oliveri
Davide Balzarotti

Abstract

The first step required to perform any analysis of a physical memory image is the reconstruction of the virtual address spaces, which allows translating virtual addresses to their corresponding physical offsets. However, this phase is often overlooked, and the challenges related to it are rarely discussed in the literature. Practical tools solve the problem by using a set of custom heuristics tailored on a very small number of well-known operating systems (OSs) running on few architectures. In this article, we look for the first time at all the different ways the virtual to physical translation can be operated in 10 different CPU architectures. In each case, we study the inviolable constraints imposed by the memory management unit that can be used to build signatures to recover the required data structures from memory without any knowledge about the running OS. We build a proof-of-concept tool to experiment with the extraction of virtual address spaces showing the challenges of performing an OS-agnostic virtual to physical address translation in real-world scenarios. We conduct experiments on a large set of 26 different OSs and a use case on a real hardware device. Finally, we show a possible usage of our technique to retrieve information about user space processes running on an unknown OS without any knowledge of its internals.
Fichier principal
Vignette du fichier
publi-6855.pdf (797.94 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03903108 , version 1 (16-12-2022)

Identifiers

Cite

Andrea Oliveri, Davide Balzarotti. In the Land of MMUs: Multiarchitecture OS-Agnostic Virtual Memory Forensics. ACM Transactions on Privacy and Security, 2022, 25 (4), pp.1-32. ⟨10.1145/3528102⟩. ⟨hal-03903108⟩

Collections

EURECOM
25 View
83 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More