Authors: Michael Cohen (Google), Arkadiusz Socala
DFRWS EU 2016
Abstract
Live Memory analysis on the Linux platform has traditionally been difficult to perform. Memory analysis requires precise knowledge of struct layout information in memory, usually obtained through debugging symbols generated at compile time. The Linux kernel is however, highly configurable, implying that debugging information is rarely applicable to systems other than the ones that generated it. For incident response applications, obtaining the relevant debugging information is currently a slow and manual process, limiting its usefulness in rapid triaging. We have developed a tool dubbed, the Layout Expert which is able to calculate memory layout of critical kernel structures at runtime on the target system without requiring extra tools, such as the compiler tool-chain to be pre- installed. Our approach specifically addresses the need to adapt the generated profile to customized Linux kernels e an important first step towards a general version agnostic system. Our system is completely self sufficient and allows a live analysis tool to operate automatically on the target system. The layout expert operates in two phases: First it pre- parses the kernel source code into a preprocessor AST (Pre-AST) which is trimmed and stored as a data file in the analysis tool’s distribution. When running on the target system, the running system configuration is used to resolve the Pre-AST into a C-AST, and com- bined with a pre-calculated layout model. The result is a running system specific profile with precise struct layout information. We evaluate the effectiveness of the Layout Expert in producing profiles for analysis of two very differently configured kernels. The produced profiles can be used to analyze the live memory through the /proc/kcore device without resorting to local or remote compilers. We finally consider future applications of this technique, such as memory acquisition.