基于元数据和指令流的64位Windows堆栈取证  

Stack Forensics Based on Meta Data and Instruction Flow of 64-bit Windows

作　　者：翟继强[1] 徐晓 陈攀 杨海陆 ZHAI Ji-qiang;XU Xiao;CHEN Pan;YANG Hai-lu(School of Computer Science and Technology, Harbin University of Science and Technology, Harbin 150080, China)

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,哈尔滨150080

出　　处：《哈尔滨理工大学学报》2021年第5期51-59,共9页Journal of Harbin University of Science and Technology

基　　金：国家自然科学基金(61403109);黑龙江省自然科学基金(F2016024);黑龙江省教育厅科学技术研究面上项目(12531121).

摘　　要：为解决64位Windows环境中,现有工具针对含有恶意进程的转储文件中没有堆栈帧指针和调试符号时,构建的堆栈取证会产生漏报问题和没有元数据时构建的堆栈取证会产生错报问题,提出了从内存转储构建堆栈跟踪方法。从内存转储中检索目标进程的用户上下文,确定堆栈跟踪的起始点,然后基于异常处理的元数据展开。如果元数据不可用,使用基于指令流的验证方法生成等效数据。基于框架Volatility实现了相应插件,实验表明,方法不依赖堆栈帧指针和调试符号,利用元数据可获取更加完整的堆栈跟踪;没有元数据时,基于指令流的验证可以极大地提高取证的精确性。To solve the omission in the stack forensics built without stack frame pointers and debugging symbols and the misstatement in the stack forensics built without meta data by the existing tools for dump files containing malicious processes in 64-bit Windows environment,a method to trace stacks from memory dumps is proposed.This method retrieves the user context of the target process from the memory dump,determines the starting point of the stack tracing and then expands the stack based on meta data for exception handling.If meta data is not available,it will generate equivalent data by using validation based on instruction flow.A corresponding plug-in was implemented based on the Volatility framework.Experiments show that this method can obtain more complete stack trace using meta data without stack frame pointers and debugging symbols,and instruction flow-based validation can greatly improve the precision of forensics without meta data.

关 键 词：内存取证 Windows堆栈 元数据 指令流 返回地址 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]