One-byte Modification for Breaking Memory Forensic Analysis

Mar 2012, Black Hat Europe 2012
https://www.blackhat.com/html/bh-eu-12/bh-eu-12-archives.html#haruyama
https://www.youtube.com/watch?v=HPgHLUVjxBU

Memory forensics is an effective technique to detect malware quickly or extract sensitive user data from RAM. Memory forensics is separated into two parts: memory acquisition and analysis. So far, some anti-acquisition methods were proposed and demonstrated, but there was no sufficient discussion about anti-analysis ones.

This presentation introduces anti-analysis methods based on unconsidered assumptions of the existing analysis tools. By using the methods, attackers can abort memory analysis and make the result empty. Since it's difficult for forensic analysts to figure out the cause from error messages, they must think acquired memory images are simply corrupted. Specifically, anti-analysis methods focus attention on three operations performed in memory analysis. All major analysis tools take several rapid approaches in these operations. If attackers want to make the analysis tools fail with the smallest modification, all they have to do is to modify only one byte of the data structure related to one approach. Of course, the modification has no impact on the running system.

The presentation is made up as follows. First, I show an overview about memory acquisition and analysis such as memory image formats, evaluation of acquisition tools, memory analyzing methods, comparison of analysis tools, and so on. Next, I point out issues of each analysis tool and key structures referred to by it, then I demonstrate all analysis tools fail by modifying data in the structures. Finally, I suggest desired usages for forensic analysts and improvement plans for developers to decrease the risk of anti-analysis methods.

Transcript

1. - / . . A .
2. • 2 – 2 : – 2 • : 2 • • 2 2 • : -
4. • 4 2 4 4 4 . ?4. – 4 . 4 2 ? 1 4 – 4 4 1 4. ? A • 1 4. . ? 1 A • 1 1 4. – . ?4 4 4 4 4. 2 . 4 42 . 4 2 4 . ?4 4 2 14 4 2 11 4
5. • , ? A G 5 A H A AGA )A • G A A – 5 5 5 ? AA – 5 55 G 55 ? AA G G A A . A? A G A GA A . AA ( 55 AA 5 AA 5 5 5 A ) A G 5 F AGA )
6. • A EI G H CB – F GH IAD /FC 6 – I B B B 6 – CCB1C G B 6 • F G IAD A EI G H CB – CCB1C G B • ACF A CB FG CB – CCB1C G B C G ACF 2CC H 6 1CA CFA HG EI G H CB 2CC G ACF A /3 GH F B I F G IAD FB H CB CH B I
7. A = =D = =I ==D 59 0C9 = 9D . 9 C • . 9 C AB= = DOI AD B = – I 9 = – 9 = = = = N = A = 5 D7 9 = 9 = M 9 =. DI M = 5 D7 9 = 9 = M 9 =. DI M= 5 D7 9 = 9 = M 9 =. DI M== 5 D7 9 = 9 = M 9 =. DI M I 9 = 036 5= = = , = 6 9 = 5= = = N = A = 2 I 0D B = AD 9 C N A 9B 1=C N , = 6 9 = = (1 5,1 )
8. 0 A DC D 1 BD : DC DDA • C B : DC DDA E C : E 8 – 6 C0C – 6 C : • 1 BD DC C : DE DC – DC : DE DC B : -42/ DC M( B :? C 3 O O O O / : E O O )
9. ( ? 9 5 6E )C E A ? • A E E C ? AC – E ? C F9 • F C A5 6E CA6 E:C A6 E • E A9 / 5AE CA6 ). 6A 6E A E 5 : 5 AC C )A 6E A 6E E
10. (C7A G G 7 EA: : :8 C )D9: C :8 DC • : :8 C 8D9: C :8 DC – DA7 A F7 : DF 7A C9 – C)7G: C18F E 79 I E – 7C9 7C 0:9A C: - FDC :C9 DF : DF M: • : DDAG 8 :8 EFD :8 DC A7 D F I7A (99F:GG :G8F E DF
11. . 02. 0 2 ) (. 0 . 2 2 . . 2 6O NA EI PM 36 4 EMN 4 6O NA 0H CA H N 5 P 5 P 5 P MD OH /E A I NE I 5 P MD OH 6O NA 48 DENA NO A 0INA 1, 0INA 1, 0INA 0INA 1, N NEIC A AMM MA IIA NE I 2 2 AM AM 2 NA 1 P A 5EMF 0I A 1AH, ,ECEN ,2 A C DEIC 3 AI M O A E D OCEIM 1O NE EICO MA D IN R H EM I 1AH R I RMEM 7 M
12. 1 2
13. • - - - ) ) - 1 ) 1 - - 1 1 ) 1 – 1 - 1 1 1 • 1 - - 1 1 ) ) ) () 3- • ) ) 1 1 1 - - - - 1 – 1 - ) 1 • 1 - - 1 1 ) ) ) 1 - ) 1 • ) ) ) 1 - - ) 31 - ) 1
14. • - / B : B I - BB: - B > : D B D : :4: BI B : > – > D D > B I>4 B >:J • D 44 B > B D • 4 D 44 B D :D 4 • BI 4A : :D: > D 4 >> D B >D - / B B : :> BI – D > I : D 4 > D 4D D :> >D: 4A : :D: > D - / B 0 1
15. • ) : – : 1 : : 1 1 : 5 5 A : A • , : – 5 : :1 : – ) : : 1 1 : 5 : : 5 A:: : : A : ( 5 1 ( : ( : .
16. • FA P RE C EO A PA D EM A P ATP P GA AH FA P E B I PE – A C L AOO FA P - 6 - • .E A ( LA EVA E ,1 ) -6 -),-6 • H PEHEP . IAS G( H C E 2 -),-6 • A , H / REPP AP H S A PP GA H D CA PDA R H AO P DE A OLA EBEA FA P : – 1 OPA PDA L L OA OP OEC P AO OE C , B PE HEP B EH AO EB PDA R H AO A D CA ) PE ) H OEO APD ( ) PE FA P RE C I EB E C DA A R H AO B I ATA
17. • A 7 A C 7 AA :7 : 7 BCA 7 – -AH A :7 ( • :7C : A 7 CG :7C7 C7 7G7C 7 AB7C A AC ?7?AC ? 7 – :7 AB7C A C7 CA ( • .7 :7 ) ) 7 :A ) 7 CG A ! 7?AC 7 - , C 17 BA 7C
19. • H G9 CFB C DI I EDH E I G C EG IEEBH – EB I B IM G C EGA – D DI CEGMN – - , GM HFED G ECC D IM I ED • E D I G EF G I EDH 9 I D C CEGM D BMH H D9B D9EDH G HH CFI EDH – 2GEFEH C I E CE H ED MI E I G B I IE I EF G I EDH • I H D H P EGI 9IEG – .I 9 DOI HF 9 9 E 9IH I 9 D EGI D BMH H – 0E CF 9I ED I G DD D HMHI C • 0E 1 DE GGEGH EG MH IE AH HIG 9I E 2GEFEH I E
20. • 2 2 2 • • 2 0 – 2 2 – 0 2
21. • 2 2 1 2 • • 1 2 – 2 1 2 – 2
22. • 69 PT A CP P A C V B E 1 OCA OV : C / PC 1:/ D C A O ACPP – 1:/ P P OCB C A O ACPP HCA 27860299 • V VP P P KRP EC 1:/ S RC D O ICO C P AC • :T O ACPPCP SC C ICO C 1:/ – 7P 9VP CK7O ACPP 9VP CK O ACPP – 7P B C7O ACPP B C O ACPP O R .BBOCPP :O P CO C 9 AC 69 BP 9 O VP A BBOCPP D O BBOCPP O P 0 O 8CE P CO 08( ) .BBOCPP :O P 3 T 7.2 ) OIP - CA C K AO P D A K C RP O OV AA ()( , 9 P
23. 3 BDE B CC 2B C D B A B CC D DBE DEB 2 2 2 : H B I 2FA 2 : H FCD I B H I :C
24. • B :,0 4) : ), H A : 4 3 • B D OB B B 0F A .CE 2 F CK R0 E S – 0 B I H KK CK 0 E A , N E C :14 3 C E ) KK KE CH C 1 E I ( HE CEC . F OH D :,0 4) : ), A RTP TP TP TP S 0F A .CE 2 F
25. • 5: I CD D 2 C D CD 5 CC • D EC 2 2 D: 2 • 2 2 A DD C 5: 5 DE CC C D A 5 D H 2 2 C F C C
26. • : FD M R LDHB .F BL DH 1 ), H 6IIF B DH 6 3 ), – C E MC DLM H MP H 6IIF B H 6 • B DM ( IK • 0A FF M DL O FD B M MC , O F :DKM F ) K LL K HLF MDIH DH 2 KH F J ( H D HM IKRS IHM 6L0HDMD F RLM 6KI LL .F BL DH 1 ), 6IIF B DH 6 3 ),
27. • 2 2 A B B 2 • B D C 7 B AC B D : B :B B : BC E :A D : BC AA A B: : E A :AB : 2 2 A 7 D A: A
28. • CBA8 GB DH CC 8 G G B G H A A ( – : ( B: 0 A G 2K G 0 B A8 0 8 0 B ABG :BHA8 H 8 ( I H H 8 GH 88 A G BA A . A 2C ,( K CBA8 )BAG : G H AG :B ( I H G A ( H G 8 A 8 GH B K BI :HA G BA
29. EGH ::E FF E BF G CB B EB D 9 2 G : G C G GJ E A ICE 2 2 F : EC9 FF A A B 2 B: BG ACEJK 2 2 F B G JFG A E C9 FF CC B 2 F B 2 A A B 2 EJ 2 FDCB: E 2 2 CE B H FF B CE G A
30. • 0 3 3 0 0 3 • 0 0 0 • 0 3 – 0 30 30 0 – 0 0 0 0 0 3 0
31. • 3 7 C C D A 7 7 E DG GD E D 7 CD C – 13 DE C 62 32 32 32 32 – 7D GD ) 7 )( • ,AA 7 7A E E CCAE G EE DE C GE 8G E DG GD E 0G EE 13 DE C 7 ,D GD ) ) ( ) C E 62 32 8 ) C E 32 8 C E 32 )(8 (. C E 4 E 7 32 8 C E 4 E 7 32 )(8 /
32. H C 3 I E DC C E: G :GHE H 3GEH:GHE C K 6 AH 2 4 6 23 2 4 6 E DC AD: H E G G E B G 3 6 E DC 4 2 C E4 M N 3 L EC EC E: G :G I ED: D D HA G 2 HEE CG4 E
33. • 8 B IP O B F T 36 B FK A EFOB OP B – B D K FHB :F 464 S • 1 OEB B FK F P G KR FI DBF K KII A DPB FO – , 2, ,- 8 , - ,- = PB F D 36 B FK A EFOB OP B KH OFHFOT . IBRK G 3R B D V2, W 6FUB
34. • D F C A 3 3A : C CDA 43 • 3 3C C: 4F D 3 C E3 D 3 3 D E A 3 A : C CDA 3 3 C AFG C E3 D 3 3
35. • O LH L GKE L ND LM E KK HA C DKL. DG 564 , – A IHKKD E LC 4 N KDHG G CDL LM H L • L 5 N KDHG A H 3L : KDHG DG ,) ,6 ( ( M KKDGB 4 N KDHG G ( CDL LM G D GL H OP HGL
36. • H F G BI – ( ( )4 6) 3 / DF (() ) ( 4 • 6 B H H ) F G HIF G – ( 3 F /4 F I GG 3 FG D F: H :HIF FK GED F H F G K : BB F B /HDGAF B G I :H D ) F G HIF G ( 3 F /4 F ) F G HIF G ( 3 F /4 F
37. • .:H 13 :FG DC – 1 :F7H C 3 GH:B :FG DCG C 1 H DC7A :7 :F • : 6 C D G 7 DF1 :F7H C 3 GH:B :FG DC( 7C CDF1 :F7H C 3 GH:B :FG DC( • .:H BDF: G : :FG DC – B:,7H73H7B C A: =:7 :F . :GG C 13 :FG DC 7C )F = H: H F: .7F :G DC :F DCH =: 1 :F7H C 3 GH:B :FG DC =: B:,7H73H7B
38. N LLDHB O KLDIH H K CDM MNK 4 F M M 8IF MDFDM K G PIKE 6 4 : H D HM GIK R 3 6 4 4 : 3L HDMD F LM G3K I LL IAAL M O FN IA G B DF G : 6CK /DLM DH 34 G M 8 KLDIH DH 4 6 K 4 L IH K KH L DH 6 8 4 IK 4 6 3 K IA DH IPL E KH F 3 C K LDBH MNK L S T T3 T K MDHB LM G8 KLDIH DH MDIH F K : 6DG M M G DH DF K
39. • 3 99 93 3 9 • 99 9 • 3 9 – 9 3 3 9 9 9 – 9 9 3 9 9
40. • D4H DE A A E E D A4D D E – A D4 GE EC 4 4 D 4 D EE E • E H D EE 4 D CD EE E • E 4 , G E D DA G E • 4 / D D G4 D EE E D C D D • 4DH A – A D4 GE I H4 G E A 4 DE • / • 0 / / • , D E 4D GE A A / 00 A DA E
41. • GE: HH B HI H ILE L B A – ) : ) 1()44 :B H :I K GE: HH AH • -4 ) B A B A – H :I K GE: HH H- I B4 HI C GE: HH G E F IE I G II . G B 1 :IH GE: HH A HI PsActiveProcessHead _EPROCESS “System” _EPROCESS “smss.exe” _EPROCESS “win32dd.exe” FLINK BLINK FLINK BLINK FLINK BLINK FLINK BLINK
42. • E EF A : A FGF DE EL GE F – 2 E = 6( (6() 4 6( 6 ) () – G F G ED FF : 6 (() 4 ) 6( • G E – HF DDA 6 6 ) () GG E A GF DA G A GL E B DE )K HG ( 2 E GG 6( (6() 4 6( 6 ) () 6 (() 4 ) 6( ::E FF
43. • BIECR CAPT MG – F MD 2: 02 S MG ADDPE TAKSE – L KAP R P BS R GMARSPE OP O ED B PEMDAM 1 KAM 4AT RR ER AK &? ( 4ERR MG EPMEK BIECR 8AMD AMR 8EL P E 1= & B RE AK GMED- .CR TE:P CE 7 M 3K M - :EB )FFD )FFD -
44. • D4H DE A: A E E BD A4D D E – : GDD A D 4 A ,. – : ). ) DB D 4 • : C 4 .DB EE A , ) ( . – E 4D B D4H DE CDB EE E DB ). ) A: , DA E 4D ECBA D 4D G AB B : 4 4 .E H .DB EE 4 4E ). )
45. ANNDIB ALIAG 4 EA NM 6AG NA N : G NDGDNR ,L HA LF ( ( . 6 5M NDPA5L AMM.A DI ( 6 5 G B DI 544 . 6 I D IN AH LRSA LAMM P GOAM DI 564) ( 5A AN .( LR 6AMK I AL )OLLAIN CLA DI 56)( 5M IDND G RMNA H5L AMM 564) K DINAL DI .6 H BA,DGA HA DI 564)
46. H , H K HE CEC P , F OH D H K : 64 ) : G F A ,CE 2 F 4K E 4 H KK H : ( : ( : : H K : ( : ( : : G 4K CN 4 H KK 1 G C G 1 FH P H K : 64 ) : 4HHE A ,E AK G F A ,CE 2 F 4K GC C E6PK F 4 H KK H K : 64 ) : G H K N EM H F A ,CE 2 F 4K GC C E6PK F 4 H KK 2HG ( P KIHG 2HG H I CGA6PK F KCHG H D G E B H F A ,CE 2 F 4K GC C E6PK F 4 H KK
47. • H D K E K O K MH 6 4 – A K O K H L RM H MA HEEHP M • S ( )1 ) ()1 H L E KH LL • HHE ) ()1 H L M E RLM KH LL • CHK I K M RLM 4 KL H ) A K H HPL D K E • A D MA H M H L ( • K MA HKR L O EH 7 8 • ERS M L MAK MHHEL ( H L H (K O K 4 H
48. 4 4 8
50. • 55 5 55 5 • 0 0 55 • 0 0 5 5 0 0 5
51. • B E BA B C DD G F D B E A FD D BC FA E BA FC D – B5= E CG A 5 BC – B5= E CG A 5 B E E C BC 1 F DD A D BA C DD F D C DD C A C DD C 5
52. • 6LHHG K B LEH G E K – 5 AC K M DL GK EG C C 1C CELE AL C A ! ( ( 2 ( ( ( 3 2 2 ( 32 )3 ( 3 ) 5 AC K 36 M CG K 2K)LCD 2LE 4( D 5 AC K 4 ( KCM 4 G ) 5 ( ( 4 G 1G LD C K ) 5 ( (
53. • - 3 - 5 3 5 - - ) 5 – - 5 5 B - • 52B ) 5 B 5 3 25 D 5 • 52B - B 5 3 D 5 (5 5 3 5 3
54. • - , - B B - ,B ,4 - - ) 5 ,4 - ( - 5 ,4 - - B ( 5 5
55. 
     
56. • , , ,5 6 , ,- 6 6 , ,5 5 - 6 5 - – 6 6 6 6, ,55 , , – - 6 , 6 5 6 ,5 , 6, - • – 5 6 6 5 6 , – ,5 6 6 , ,5 , ,5 , ,5 ,
57. ) 7 ? : : 7 ! (5 5 : : @
58. 
    
59. 
    
60. 
    
61. H I 938K[b 7K ]5 W [Y 0R]] / RL K[b MYW PK ]N W " [Y1 H I 6 4K O FS 6 L SVN"S ]YYV YP 6 4K O 0R]] / SNK MO YP] K[O MYW 1 H(I YY BYV FS NY OWY[b CYYVUS] 0R]] / WYY YV MYW S NY "WOWY[b"]YYVUS] 1 H)I AO O[_ON 2NN[O B KMO S FS NY Rb SMKV OWY[b 0R]] / MMS MYMYVY " SP]b MYW LVY NO_SMO"[O O[_ON R]WV1 H I EYVK]SVS]b 7[KWO Y[U 0R]] / _YVK]SVO b ]OW MYW NOPK V] _YVK]SVS]b1 H I ]SWOVS O[ V S 0R]] / VOONK LVY Y] MYW . _YVK]SVS]b" "]SWOVS O[" [O S ][bK S R]WV1 H I D NK]O/ OWY[b 7Y[O SM 6 BM[S ] 0R]] / MMS MYMYVY " SP]b MYW LVY ( WOWY[b" PY[O SM R]WV1 H-I K NSK ] AONVS O 0R]] / WK NSK ] MYW [YN M] P[OO YP] K[O [ONVS O 1 H.I K NSK ] OWY[bcO 0R]] / WK NSK ] MYW [YN M] P[OO YP] K[O WOWY[bcO 1 H I B925 F F2< 6A AKS S CRO 3K[ 7Y[ AYY]US] 0R]] / LVKMURK] MYW [O O ]K]SY LR"T " LR"T " " K[U "L ]VO[ NP1 H I O]O[ [O]O[ 2 ]S OWY[b 7Y[O SM OWY[bcO BM[S ] 0R]] / ] a M LVY Y] MYW WO]O[ [O]O["K ]S"WOWY[b"PY[O SM R]WV1 H I AYL ] BS K] [O PY[ O[ OV 5K]K B][ M] [O 0R]] / MM K]OMR ON dL[O NK MM . S O NP1 H (I :NO ]SPbS OWY[b :WK O 0R]] / VOONK LVY Y] MYW SNO ]SPbS "WOWY[b" SWK O R]WV1 H )I G DA 4< D5 :B :> G 4 6C 0R]] / WONSK LVKMURK] MYW LR"NM" B SMRO 3VKMU9K] 54 B SMRO 4VY N YMUO]" NP1 H I 7S NS LTOM] AYY] S ES ]K 4A 0R]] / LVY MRK]cPY[O SM MYW K PS NS " YLTOM]"[YY] "S "_S ]K"U M[ 1 AOPO[O MO