Live Memory Forensics on Virtual Memory

Memory forensics is a collection of techniques using a machine’s memory footprint and a machine and locate traces of processes, files, and network connections. This has proven to be beneficial for identifying malicious factors in the aftermath of an attack. However, these techniques are mainly based on the analysis of physical memory. In this work, we experiment with virtual memory and discover how memory forensics can be performed directly in virtual memory. We substantiate our findings through the deployment of advanced techniques such as pool tag quick scanning and PTE/PFN database analysis, both techniques represent the state of the art in memory forensics for enumerating kernel objects and detection of code injection in processes. Our work is a prototype for many use cases such as live kernel inspection (similar to winDBG), providing metadata for memory extraction images, an anti-cheat engine using memory forensics for detection, and Endpoint Detection and Response with memory forensics.