Re: [Vol-users] Anti-forensic resilient memory acquisition [was: An evaluation platform for forensic memory acquisition software.]
George M. Garner Jr.
19 Aug
2013
19 Aug
'13
3:58 p.m.
Michael,
On 8/19/2013 1:56 PM, Michael Cohen wrote:
Hi George,
According to the wikipedia (the oracle of all knowledge :-):
http://en.wikipedia.org/wiki/Cache_coherence
<quote>
In a shared memory multiprocessor system with a separate cache memory
for each processor, it is possible to have many copies of any one
instruction operand: one copy in the main memory and one in each cache
memory. When one copy of an operand is changed, the other copies of
the operand must be changed also. Cache coherence is the discipline
that ensures that changes in the values of shared operands are
propagated throughout the system in a timely fashion.
</quote>
Thanks for the link to the Wiki article and quote. The article on its
face refers to cache COHERENCE of shared memory on a multiprocessor
system where each processor maintains its own separate cache. The
specific passage quoted above concerns coherence of the instruction
cache; however, we will assume that the same applies equally to the data
cache. Nothing in this article discusses or even contemplates the
remapping of an individual memory page with incompatible memory caching
attributes or the possibility that memory CORRUPTION may occur as the
result. Memory coherence and memory corruption are two different
things. Indeed, if memory corruption does occur, cache coherence
ensures that the corruption will be propagated to every processor on the
system! Thus, the phenomenon to which you refer actually amplifies the
problem, rather than solves it.
The remapping of physical memory pages with incompatible memory caching
attributes and the possibility that memory corruption may result is
specifically addressed by Section 11.12.4 Vol 3A of the Intel Software
Developer's Manual. This section provides a specific set of steps which
must be followed to safely remap physical memory with incompatible cache
attributes. I don't see anything in this section which restricts its
application to the case where someone will be writing to both
incompatibly mapped virtual addresses. In any event, using my DD
utility on Windows 2000 (before MS started ensuring caching
compatibility of pages mapped using \Device\PhysicalMemory) I saw plenty
of examples of strange behavior of systems after acquiring physical
memory which suggested that memory corruption had occurred. I don't
particularly care to return to that era!
In any event, the wiki passage which you cite does not really respond to
the issue.
Regards,
George.