Next month href="/content/fireeye-www/en_US/services/freeware/memoryze.html"
target="_blank">Memoryze will be two years old and a lot
has changed over that time. There has been a lot of interesting
research in the field of memory forensics, and responders are
finding value in the analysis.
Platform Support
From a tool perspective, other than
the addition of a GUI called href="http://www.mandiant.com/products/free_software/mandiant_audit_viewer/"
target="_blank">Audit Viewer and the added usability that the
href="http://www.mandiant.com/uploads/presentations/DoD_2010_PS.pdf"
target="_blank">Malware Rating Index (MRI) provides, the most
noticeable change is the expanding platform support. Today, we are
announcing the release of
href="/content/fireeye-www/en_US/services/freeware/memoryze.html">Memoryze
1.4.2900 which has added support for:
- Windows 7
64-bit - Windows 7 32-bit*
- Windows 2008 64-bit*
This is in addition to the platforms Memoryze already
supported:
- Windows 2000 Service Pack 4 (32-bit)
- Windows XP Service Pack 2 and Service Pack 3 (32-bit)
- Windows Vista Service Pack 1 and Service Pack 2 (32-bit)
- Windows 2003 Service Pack 2 (32-bit)
- Windows 2003
Service Pack 2 (64-bit)
Attacks Against Memory Forensic Tools
href="http://moyix.blogspot.com/2010/07/plugin-post-robust-process-scanner.html"
target="_blank">Brendan Dolan-Gavitt et. al. published a great
article in the Proceedings of the ACM Conference on Computer and
Communications Security (CCS) [1]. In it, they discuss an
attack against memory forensic tools that would cause the tools to
be blind to the existence of specially modified processes. As
Brendan states in his blog, this attack has been known about for
some time and requires a rootkit on the part of the intruder in
order to modify the desired process(es). Memoryze has expanded upon
their research by modifying the detection algorithm slightly and
adding support for all the operating systems Memoryze supports. This
work by Dolan-Gavitt, Srivastava, Traynor, and Griffin is sure to
motivate change. If you would like to test your existing tools or
validate that Memoryze is now resilient, Brendan has made a memory
image available for download from his href="http://moyix.blogspot.com/2010/07/plugin-post-robust-process-scanner.html"
target="_blank">blog.
href="https://www.fireeye.com/content/dam/legacy/ammo/DKOM_mem2.jpg"> width="400" height="200"
src="https://www.fireeye.com/content/dam/legacy/ammo/DKOM_mem2.jpg"
title="DKOM and Memory Analysis"
class="aligncenter size-full wp-image-1507" />
Speed Improvements
In addition to platform support and
resilience to recent DKOM attacks, Memoryze is now as much as 40%
faster depending on memory size and configuration parameters. This
and some of the other improvements made should make string
enumeration a lot better.
Portable Installation
Peter Villadsen fixed a bug in
the way Memoryze used to install that required the user to use
"-portable" at the command line when running Memoryze.
Obviously, this broke Audit Viewer because of the way it invokes
Memoryze. Now that has been fixed. When you are installing Memoryze
to be used portably, you must use special options to msiexec.
msiexec /a MemoryzeSetup.msi /qb
TARGETDIR=portable_drive_and_folder
The
portable_drive_and_folder should be the drive letter of the USB key
and the folder you want to install Memoryze into such as
H:Memoryze
Now, the first time you run portable Memoryze it
will create several files; therefore, you cannot make the media
read-only yet. After that, you should be set to run Memoryze off a
USB key or CD-Rom. You can have Audit Viewer invoke Memoryze or use
the *.bat files that are included.
It has been fun over the
past two years working with our user base and our consultants as
they have ran this code over literally hundreds of thousands of
hosts. I am looking forward to what the next two years bring.
href="/content/fireeye-www/en_US/services/freeware/memoryze.html"
target="_blank">Download Memoryze NOW
[1]
Dolan-Gavitt, B., Srivastava, A., Traynor, P., and Giffin, J.,
"Robust signatures for kernel data structures," in
Proceedings of the ACM Conference on Computer and
Communications Security (CCS), 2009.
The "*" means that complete regression testing on those
platforms has not been completed, but we felt the feature was
important enough to users to get the feature out as soon as it was
available.
