浏览器隐私模式下进程内存数据快速获取方法  

Fast access to process memory data in private browser mode

作　　者：李豪俊[1] 陈龙[1] 田庆宜[2] 

机构地区：[1]重庆邮电大学计算机取证研究所,重庆400065 [2]重庆市公安局电子物证司法鉴定中心,重庆400065

出　　处：《计算机应用》2012年第A01期50-52,55,共4页journal of Computer Applications

基　　金：重庆市教委科学技术研究项目(KJ110505);重庆市科技攻关计划项目(CSTC;2011AC2155)

摘　　要：浏览器隐私模式使得用户浏览行为的取证调查变得困难,相关证据只能来自于内存。提出一种获取活动进程内存空间的方法,通过使用目标进程的CR3寄存器的内容替换当前进程的CR3寄存器的内容,使当前进程可获取目标进程的页目录和页表等信息,进而访问并获取目标进程内存空间。相对于先对内存进行完整镜像再获取目标进程数据空间的方法,缩小了下一步对用户浏览行为进行分析所涉及的数据范围,获取进程内存空间数据的速度更快。该方法也适用于目标明确的单个或几个其他进程的内存数据获取。Private browsing mode makes it difficult to take evidence because people have to get evidence from memory. This paper presented a method to acquire the space of active processes memory. Through replacing the content in the CR3 registers of the current process with the one in the CR3 registers of the target process, the current process can obtain the page directories and the page tables of the target process and it is possible that current process can access and acquire the memory space of the target process. Compared with imaging the physical memory and then obtaining the memory space of target process, the new method limits the data scope of analyzing users＇ browsing behavior in next setup and accesses to the memory space of process much faster. The method is also applicative for the acquisition of specific processes memory data in other

关 键 词：计算机取证 内存取证 WEB浏览器 隐私浏览模式 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]