Authors: Joe Sylve, Ph.D. (BlackBag Technologies), Vico Marziale, Ph.D. (BlackBag Technologies), and Golden Richard III, Ph.D. (Louisiana State University)
DFRWS EU 2016
Abstract
Pool tag scanning is a process commonly used in memory analysis in order to locate kernel object allocations, enabling investigators to discover evidence of artifacts that may have been freed or otherwise maliciously hidden from the operating system. The fastest current scanning techniques require an exhaustive search of physical memory, a process that has a linear time complexity over physical memory size. We propose a novel technique that we are calling “pool tag quick scanning” that is able to reduce the scanning space by 1e2 orders of magnitude, resulting in much faster discovery of targeted kernel data structures, while maintaining a high degree of accuracy.