[Vol-dev] Ideas and suggestions for user space memory forensics

Hi developers and enthusiasts, A while ago I introduced myself here, as I am doing a study into user space memory forensics. My goal is to develop a general method to extract information from user space, from any process. The past few months I have worked on some proof of concepts, and some basic experimentation. This has all been fairly easy, but I want to do something more complex. Today I am mailing you to ask for some ideas and suggestions. To give you an idea of what I have done so far (and the level I'm working on), here's a short list: - Extract register contents from the process kernel stack - Determine the exact locations of stack frames - Make a list of all process threads and access their stacks - Walk a list of pointers and do heuristic search on small structs, such as common networking structs (NOTE: All using a linux dump) All of this worked fairly well, and it was fun, but not exactly groundbreaking. I thought it would be best to ask the advice from professionals before I continue. The direction I would like to take is doing something more foolproof than a heuristic search, I would rather derive the location of structures using information in memory. One idea I had was to identify the whole stack trace (i.e. including function names) and use this to find struct locations. Since there is always the issue of missing symbols, I would somehow have to reintroduce these, and also figure out how dynamic symbols work. I am especially interested in common libraries with this approach, since something I can apply to libraries, I can apply to many processes. Another idea I had would be to use the source/headers of the application, maybe similar to the way volatility uses the symbols for the kernel. Now I don't really have a question about this, I am just looking for ideas. Please tell me if you think my ideas are good, or bad. If you read this and wonder why I don't do X instead of Y, please ask me. Feel free to mention any problems you see coming. I am really looking for a discussion here. The only requirements I have at this moment are that it stays roughly the same topic and it is academically relevant. That last part also means that if you know about somebody doing exactly this, do let me know, so I can do something else. If you know of any technical documentation or scientific research in the area, I'm also interested in that. The most relevant paper (in the whole topic of user space memory forensics) I have read so far is "Digging for Data Structures", Cozzie et al (thanks emdel for showing me that one). I permanently reside on IRC, Freenode/#volatility, if anyone cares to chat some more about the topic. Cheers, Edwin