Abstract Memory forensics is useful to provide a fast triage on running processes at the time of memory acquisition in order to avoid unnecessary forensic analysis. However, due to the effects of the execution of the process itself, traditional cryptographic hashes, normally used in disk forensics to identify files, are unsuitable in memory forensics. Similarity digest algorithms allow an analyst to compute a similarity score of inputs that can be slightly different. In this paper, we focus on the issues caused by relocation of Windows processes and system libraries when computing similarities between them. To overcome these issues, we introduce two methods ( Guided De-relocation and Linear Sweep De-relocation ) to pre-process a memory dump. The goal of both methods is to identify and undo the effect of relocation in every module contained in the dump, providing sanitized inputs to similarity digest algorithms that improve similarity scores between modules. Guided De-relocation relies on specific structures of the Windows PE format, while Linear Sweep De-relocation relies on a disassembling process to identify assembly instructions having memory operands that address to the memory range of the module. We have integrated both methods in a Volatility plugin and evaluated them in different scenarios. Our results demonstrate that pre-processing memory dumps with these methods significantly improves similarity scores between memory modules.

中文翻译：

---

预处理内存转储以提高 Windows 模块的相似性分数

摘要 内存取证有助于在获取内存时对正在运行的进程进行快速分类，以避免不必要的取证分析。然而，由于进程本身执行的影响，通常用于磁盘取证以识别文件的传统加密哈希不适合内存取证。相似性摘要算法允许分析师计算可能略有不同的输入的相似性分数。在本文中，我们重点讨论了 Windows 进程和系统库在计算它们之间的相似性时重定位所引起的问题。为了克服这些问题，我们引入了两种方法（Guided De-relocation 和 Linear Sweep De-relocation）来预处理内存转储。这两种方法的目标都是识别并消除转储中包含的每个模块中重定位的影响，为相似性摘要算法提供经过消毒的输入，以提高模块之间的相似性分数。Guided De-relocation 依赖于 Windows PE 格式的特定结构，而 Linear Sweep De-relocation 依赖于反汇编过程来识别具有寻址到模块内存范围的内存操作数的汇编指令。我们在一个 Volatility 插件中集成了这两种方法，并在不同的场景中对它们进行了评估。我们的结果表明，使用这些方法预处理内存转储可以显着提高内存模块之间的相似度得分。Guided De-relocation 依赖于 Windows PE 格式的特定结构，而 Linear Sweep De-relocation 依赖于反汇编过程来识别具有寻址到模块内存范围的内存操作数的汇编指令。我们在一个 Volatility 插件中集成了这两种方法，并在不同的场景中对它们进行了评估。我们的结果表明，使用这些方法预处理内存转储可以显着提高内存模块之间的相似度得分。Guided De-relocation 依赖于 Windows PE 格式的特定结构，而 Linear Sweep De-relocation 依赖于反汇编过程来识别具有寻址到模块内存范围的内存操作数的汇编指令。我们在一个 Volatility 插件中集成了这两种方法，并在不同的场景中对它们进行了评估。我们的结果表明，使用这些方法预处理内存转储可以显着提高内存模块之间的相似度得分。