26 A Review of “Pre-processing Memory Dumps to Improve Similarity Score of Windows Modules”

Memory forensics is useful to provide a fast triage on running processes at the time of memory acquisition in order to avoid unnecessary forensic analysis. However due to the efects of the execution of the process itself, traditional cryptographic hashes are insuitable in memory forensics. Similarit...

Descripción completa

Detalles Bibliográficos
Autores: Martín-Pérez, Miguel, Rodríguez, Ricardo J., Balzarotti, Davide
Tipo de recurso: capítulo de libro
Fecha de publicación:2021
País:España
Institución:Universidad de Castilla-La Mancha
Repositorio:RUIdeRA. Repositorio Institucional de la UCLM
OAI Identifier:oai:ruidera.uclm.es:10578/28632
Acceso en línea:http://doi.org/10.18239/jornadas_2021.34.26
http://hdl.handle.net/10578/28632
Access Level:acceso abierto
Palabra clave:similarity digest algorithms
memory forensics
Windows
relocation
Descripción
Sumario:Memory forensics is useful to provide a fast triage on running processes at the time of memory acquisition in order to avoid unnecessary forensic analysis. However due to the efects of the execution of the process itself, traditional cryptographic hashes are insuitable in memory forensics. Similarity digest algorithms allow an analyst to compute a similarity score of inputs that can be slightly di erent. In this paper, we focus on the issues caused by relocation of Windows processes and system libraries when computing similarities between them. To overcome these ssues, we introduce two methods (Guided de-relocation and lineas sweep de-relocation) to pre-process a memory dump. The goal of both methods is to identify and undo the efect of relocation in every module contained in the dump, providing sanitized inputs to similarity digest algorithms that improve similarity scores between modules. Guided de-relocation relies on specific structures of the Windows PE format, while Linear Sweep De-relocation relies on a disassembling process to identify assembly instructions having memory operands that address the memory range of the module. We have evaluated them in diferent scenarios. Our results demonstrate that pre-processing memory dumps with these methods significantly improves similarity scores between memory modules. In addition, both methods have been integrated in a Volatility plugin.