没有合适的资源?快使用搜索试试~ 我知道了~
首页Windows NT pagefile.sys内存分析:虚拟内存技术与安全挑战
本文档深入探讨了Windows NT操作系统中的pagefile.sys虚拟内存分析。作者Michael Gruhn,来自德国埃尔朗根-纽伦堡弗里德里希-亚历山大大学计算机科学系和IT安全基础设施部门,针对随着硬盘加密、RAM磁盘、持久数据避免技术和内存驻留恶意软件的普及,系统内存分析的重要性日益提升。在物理内存不足时,Windows NT通过将内存帧转移到页面文件(pagefile.sys)来扩展虚拟内存,这使得传统的内存分析工具可能无法捕捉到这些动态变化,从而漏掉了关键信息。 作者提出了一个详细的Windows NT页面分析方法,采用动态灰盒分析策略。在这个过程中,他们将已知数据故意放入虚拟内存,并追踪这些数据在物理内存和页面文件中的映射位置。同时,他们还将分析结果与Windows NT研究内核源代码进行交叉参考,以便准确理解和解码非现态页表条目。这种方法不仅能够揭示物理内存的完整情况,还能精确重建包括非现态内存页在内的整个虚拟内存空间,弥补了现有工具的不足。 通过这种方式,研究人员能够更深入地理解Windows NT系统的内存管理机制,这对于逆向工程、安全审计以及恶意软件分析具有重要意义。这种技术有助于检测内存占用异常,防止敏感信息泄露,同时也有助于开发出更有效的内存保护措施和取证工具。这篇论文提供了一种强大的工具,帮助专业人士更好地评估和应对内存安全威胁,是深入研究Windows NT虚拟内存管理不可或缺的参考资料。
资源详情
资源推荐
![](https://csdnimg.cn/release/download_crawler_static/16821201/bg4.jpg)
and pagefile can be controlled. The more memory swapforcer allocates, the more frames of the ramwrite process
are swapped into the pagefile.
C. Inferring the Virtual Address Translation
Once ramwrite and swapforcer are executed on a system, the physical memory and pagefile can be acquired. In
section IV we will go into detail how this is can be done on Windows NT. The analysis then consist of
1) figuring out the mapping of virtual crib page addresses to physical crib frame addresses and offsets, and
2) inferring how the operating system “remembers” this mapping.
The first is trivial. A simple program find_addr <offset> <addr> was created that searches the input at the
specified offset <offset> for a crib page starting with the 32-bit value given by the <addr> parameter.
The second step is more complicated and has, in some parts, to be done via manual reverse engineering:
1) The hardware dependent address translation must be interpreted.
2) The software dependent address translation must be interpreted.
The hardware dependent address translation is specified by the hardware manufacturer. Address translation is done via
paging tables. For this the operating system has to store the base address of the root table somewhere. In subsection V-A
we will detail how this base address can be found on Windows NT systems. Once this base address is extracted the paging
table tree can be traversed.
After the hardware dependent address translation part is implemented in the memory analysis process, it is recommended
to test it with memory dumps of the ramwrite program without any crib data being forced into the pagefile. The memory
analysis process should be able to perfectly reconstruct the crib data, i.e., bring each crib frame into correct order.
For the software dependent part a trial-and-error process is used. We currently assume the correlation between virtual
addresses and offset in the pagefile can be inferred from the page table entry itself. At least this is true for Windows NT and
Linux (cf. swp_entry_t and pte_to_swp_entry() in the Linux source code
3
). If a different system does not use
the page table entries to store this information, the relevant data structure must be found within the operating system data
structures. Here the location, i.e., addresses and offsets, of the crib pages and crib frames can be used to verify found data
structures. Even though, theoretically an exhaustive search for crib frame addresses and offsets could be used the amount of
possible candidates for operating system data structures could be overwhelming. Our findings so far, however, indicate that
the crib frame offset into the pagefile, can be determined, by appropriately shifting and masking the page table entry value.
III. WINDOWS NT X86 AND X64 VIRTUAL MEMORY OVERVIEW
In this section we give an overview over virtual memory translation for Windows NT x86 and x64 with 32 Bit, PAE
and IA32e Paging. The information herein was derived via the techniques described in the previous section and was further
extended and verified via cross-referencing the Windows NT Research Kernel source code [10].
A. pagefile.sys
Before the paging overview we briefly explain the pagefile of Windows NT. The default pagefile on Windows NT systems
is called pagefile.sys. On default it is stored in the root directory of the file system the operating system is installed
on, i.e., %SystemRoot%\pagefile.sys. However, up to 16 pagefiles can exist. Their name, location, minimum and
maximum size in MiB are specified in the registry strings stored in the following entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles
With each string entry having the following form:
<path to pagefile> <minimum size in MiB> <maximum size in MiB>
The pagefiles are numbered, starting from 0 to 15 beginning with the first entry in the PagingFiles registry entry. At
runtime the Windows NT kernel keeps a _MMPAGING_FILE structure for each pagefile. The most relevant fields are
lkd> dt nt!_MMPAGING_FILE
+0x018 File : Ptr32 _FILE_OBJECT
+0x024 PageFileName : _UNICODE_STRING
+0x040 PageFileNumber : Pos 0, 4 Bits
+0x044 FileHandle : Ptr32 Void
3
https://www.kernel.org/
剩余15页未读,继续阅读
![docx](https://img-home.csdnimg.cn/images/20210720083331.png)
![docx](https://img-home.csdnimg.cn/images/20210720083331.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://profile-avatar.csdnimg.cn/default.jpg!1)
weixin_38528180
- 粉丝: 4
- 资源: 942
上传资源 快速赚钱
我的内容管理 展开
我的资源 快来上传第一个资源
我的收益
登录查看自己的收益我的积分 登录查看自己的积分
我的C币 登录后查看C币余额
我的收藏
我的下载
下载帮助
![](https://csdnimg.cn/release/wenkucmsfe/public/img/voice.245cc511.png)
最新资源
- Vue实现iOS原生Picker组件:详细解析与实现思路
- Arduino蓝牙小车:参数调试与功能控制
- 百度Java面试精华:200页精选资源涵盖核心知识点
- Swift使用CoreData填坑指南:CoreData在Swift 3.0的变化
- 微距离无线充电器创新设计及其实验探索
- MTK Android平台开发全攻略:44步详解流程
- RecyclerView全面解析:替代ListView的新选择
- Android开发:自动适配中英文键盘解决方案
- Android调用WebService接口教程
- Android开发:BitmapUtil图片处理全解析与实例
- Android多线程断点续传实现详解
- PCA算法在人脸识别会议签到系统中的应用
- EventBus 3.0:Android事件总线详解与实战应用
- Android FileUtil:全面解析文件操作实用技巧与实例
- RecyclerView添加头部和尾部实战教程
- Android实现微博滑动固定顶部栏实战与优化
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035111.png)
安全验证
文档复制为VIP权益,开通VIP直接复制
![](https://csdnimg.cn/release/wenkucmsfe/public/img/green-success.6a4acb44.png)