DScope: To Reliably and Securely Acquire Live Data from Kernel-Compromised ARM Devices

Live data acquisition from a mobile device controlled by a corrupted kernel is challenging as the adversary can block data reporting from the inside and also sabotage external I/O interactions. This paper proposes DScope as a reliable live data acquisition system for ARM devices without trusting their kernels. It ensures that a device user can always launch DScope to securely extract the needed virtual memory data when the device is under attack. Besides its reliability, DScope also preserves kernel semantic and support user-customized acquisition routines. We have built a prototype of DScope on a Raspberry Pi 4 development board and have also tested DScope ’s reliability against various forms of denial of service attacks. Our experiments show that a user can dynamically import data acquisition routines to the device to extract kernel objects and runtime stacks from an attack scene or a kernel crashing site.