Similar kernel-based mobile phone dynamic memory extraction method

Abstract

The invention relates to a similar kernel-based mobile phone dynamic memory extraction method. The method comprises the steps of selecting similar kernel source codes; collecting target system information; compiling kernel source codes; generating a .config file in a root directory; constructing a kernel module; disabling a check mechanism and re-compiling a kernel; performing cross-compilation on the source codes; compiling an external module by using an LiME tool; uploading the LiME module to a target mobile phone, and loading the module by using an insmod command; searching for a function with a dependency relationship with a _gnu_mcount_nc symbol variable in the similar kernel source codes; exporting a _gnu_mcount_nc symbol to outside; performing kernel configuration in the similar kernel codes; entering an LiME directory and assigning an external source code path to the similar kernel codes; and generating a dump memory file in an SD storage card of an Android terminal, and extracting the memory file in the mobile phone to a local computer by using pull operation at a local terminal.

Description

technical field [0001] The invention relates to a mobile phone dynamic memory extraction method, in particular to a mobile phone dynamic memory extraction method based on a similar kernel. Background technique [0002] Compared with the traditional direction of mobile phone forensics, dynamic memory forensics is an emerging field, so there are relatively few researches on dynamic memory forensics and analysis. At present, no relevant research results have been published in China, and the relevant research results are mainly concentrated in some digital survey research institutions abroad. So far, the research on mobile phone dynamic memory forensics has mainly gone through three stages, that is, the forensics method based on the command line, which is mainly represented by the kill command under the Android terminal; the forensics method based on the Android debugging tool, that is, the Android debugging tool DDMS; and Forensics methods based on compiled modules are mainly ...

AI Technical Summary

Problems solved by technology

Since LiME has been used for a short time, and the use process needs to obtain the corresponding device source code and compile it, the lack of a mature system extraction program greatly limits the work efficiency of investigators in extracting dynamic memory.