Physical memory mirror image document analysis method of Linux system

Abstract

The invention discloses a physical memory mirror image document analysis method of a Linux system. The physical memory mirror image document analysis method of the Linux system comprises the following steps: a) judging the version of an operating system and obtaining a page directory address; b) carrying out address conversion; c) recovering a stored system kernel symbol table in a database; d) recovering system kernel symbols which are not stored in the database; e) obtaining system key information; and f) obtaining a module exporting symbol table. The step c) comprises the following steps: c-1) obtaining a number of kernel symbols; c-2) obtaining the types and the names of the kernel symbols; and c-3) obtaining the virtual addresses of the kernel symbols. The step e) comprises the following steps: e-1) obtaining process information and document information; e-2) obtaining loaded module information; and e-3) obtaining a network, a CPU (Central Processing Unit), a log and debugging information. The analysis method exhibit general applicability, breaks through boundedness that a traditional method must know internal system version information and additional kernel symbol table documents, provides the general analysis method for the memory of the Linux system, and has outstanding beneficial effects.

Description

technical field [0001] The present invention relates to a kind of Linux system physical memory image file analysis method, more specifically, relate to a kind of Linux system physical memory image file that can restore kernel variable symbol table from physical memory image without knowing the version information of operating system Analytical method. Background technique [0002] In 2002, Kornblum of the U.S. Air Force Special Investigations Office published a theme report titled "Preservation of Fragile Digital Evidence by First Responders" in DFRWS (Digital Forensic Research Workshop), in which he proposed the need to investigate volatile memory information to obtain comprehensive and accurate evidence of cyber attacks and cyber crimes . In order to promote the development of physical memory analysis technology, DFRWS launched a memory forensic analysis challenge for Windows systems in 2005, aiming to extract hidden processes and their Stealth method; DFRWS launched a m...

AI Technical Summary

Problems solved by technology

[0008] (3) The operation steps of the tools implemented by the current analysis method are relatively complicated. Taking VolatilityFramework, which is currently widely used, as an example, the following configuration needs to be done before use:

If given a physical memory image file of unknown operating system version, it will not be processed

Images