By: Alcapone666

During acquiring the evidence from a running compromised system investigators often dump \\Device\PhysicalMemory object using dd tool (The size of dumped image is equal to total RAM size presented in system).

Process of an initial incident response can be split into two simple steps. Step 1: to collect volatile data (memory). Step 2: to collect non volatile data (volumes or drivers). There are a lot of tools to analyze Windows file systems (The Sleuth Kit or Encase). Also there are tools to online memory analyze such as physmem and livekd from Sysinternals or winkdump from crazylord article.
But, how to analyze dumped memory image file for instance to recover list of active processes?
The simplest method of offline analysis is presented below:

- open image file in hex editor
- we have to know virtual addresses of PsActiveProcessHead (but we can start from KiWaitInListHead address, etc…) and structure of EPROCESS block
- then we can find all active processes and much more…(we can go deeper into image of memory, printing handle table, process environment blocks, etc…)

Example:
Virtual address of PsActiveProcessHead in W2K with SP4 = 8046e460.
As we can see, after opening image file addresses starts from 0. So physical address of double linked list PsActiveProcessHead is located at 0046e460. (By default Windows 2000 allocates kernel address space in the upper half of the 4 GB virtual address space)

0046e460 80 86 69 81 60 b4 0b 81 00 00 00 00 00 00 00 00 |..i.`...........|
0046e470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0046e480 01 00 00 00 7c 8b c0 f3 02 00 00 00 01 00 04 00 |....|...........|


The virtual address of last active process is at (810bb460 - a0) = 810bb3c0. So the address in image file is at 010bb3c0. To print ImageFileName of this process we have to look at offset (1fc) from the beginning of process (010bb5bc). Because of listing only one word in line by hex editor and starting from 0 we have to find the following address 010bb5b0. Here is the result:


010bb5b0 00 00 00 00 00 00 00 00 00 00 00 00 64 64 2e 65 |............dd.e|
010bb5c0 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |xe..............|


I hope, that this handy method will be helpful for some forensic investigators.

read comments (10) / write comment

recent comments:

Good vs. Evil	fuzen_op	07.Jun:13:14
Cross-posted	hoglund	05.Jun:12:56

printer-friendly version