Physical Memory Forensics via Virtual Address Descriptor Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional techniques for analyzing physical memory face challenges such as missing data and misattributed data, which hinder the accurate reconstruction of processes and files, reducing the efficacy of information security incident response and forensic investigations.
Innovation Solution
The method involves traversing and parsing Operating System data structures related to memory-mapped binaries, using virtual address descriptors to acquire complete process data and reconstructing mapped binary data, and employing hashing to determine potential compromises by comparing generated hash values with control values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional brute force translation of process virtual address range is used, then complete process data acquisition is attempted, but misattributed data occurs due to OS I/O cache mapping conflicts
Solution Approach 1:
The patent introduces Virtual Address Descriptors (VADs) as an intermediary data structure that mediates between the brute force translation approach and the final process reconstruction. VADs store metadata about virtual address ranges and their associations with specific processes, allowing the system to filter and attribute memory pages accurately without directly conflating OS cache mappings with process-specific mappings. This intermediary layer resolves the contradiction by enabling precise data attribution while maintaining complete process data acquisition.
2Productivity
If pages are trimmed from process working set when not currently needed, then memory management efficiency is improved, but invalid page references are created causing missing data
Solution Approach 1:
The patent applies preliminary action by capturing and storing Virtual Address Descriptor (VAD) information before the trimming process occurs. The system records the virtual address ranges and their process associations in advance, creating a historical map of process memory usage. When pages are later trimmed from the working set, this pre-captured VAD data allows the forensic system to reconstruct the complete process image by retrieving pages from disk or other storage, using the previously stored VAD information to guide the reconstruction process and avoid missing data.
3Device complexity
If virtual address to physical address translation is performed without VAD structures, then simple translation is achieved, but accurate process reconstruction is hindered due to complex OS memory abstraction
Solution Approach 1:
The patent segments the complex virtual address to physical address translation process into distinct manageable components. Instead of attempting a single-step translation that must handle all OS memory abstraction complexities, the system breaks down the process into: (1) identifying the virtual address range using VAD structures, (2) determining the associated process from VAD metadata, (3) translating individual page addresses within that range, and (4) reconstructing the process image by assembling translated pages. This segmentation allows each step to be handled with appropriate complexity, resolving the contradiction between translation simplicity and reconstruction accuracy.
Data Source
AI summary
The method of the present inventive concept is configured to utilize Operating System data structures related to memory-mapped binaries to reconstruct processes. These structures provide a system configured to facilitate the acquisition of data that traditional memory analysis tools fail to identify, including by providing a system configured to traverse a virtual address descriptor, determine a pointer to a control area, traverse a PPTE array, copy binary data identified in the PPTE array, generate markers to determine whether the binary data is compromised, and utilize the binary data to reconstruct a process.