Research on Linux Kernel Version Diversity for Precise Memory Analysis

• 作者: Guangqi Liu Lianhai Wang Shuhui Zhang Xiangxu Meng
• 来源期刊: 国际计算机前沿大会会议论文集
• 学科: 社会科学
• 关键词: MEMORY analysis Linux MEMORY FORENSICS Brute-force MATCHING
• 年，卷（期）: 2017,（1）
• 页码范围: 93-95
• 页数: 3页
• 分类号: C5

摘要

The diversity of Linux versions brings challenges to Linux memory analysis,which is an established technique in security and forensic investigations.During memory forensics,kernel data structures are essential information.Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions.In this paper,by collecting and analyzing a number of Linux versions,we characterize the properties of different Linux kernel versions and how struct offsets change between versions.Furthermore,the Linux kernel provides over 10,000 configurable features,which leads to different kernel structure layouts for the same kernel version.To deal with this problem,we propose a method of identifying kernel struct layout based on brute-force matching.By examining the relationships between kernel structures,common features are extracted and exploited for brute-force matching.The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.