Research on Linux Kernel Version Diversity for Precise Memory Analysis

Abstract

The diversity of Linux versions brings challenges to Linux memory analysis, which is an established technique in security and forensic investigations. During memory forensics, kernel data structures are essential information. Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions. In this paper, by collecting and analyzing a number of Linux versions, we characterize the properties of different Linux kernel versions and how struct offsets change between versions. Furthermore, the Linux kernel provides over 10,000 configurable features, which leads to different kernel structure layouts for the same kernel version. To deal with this problem, we propose a method of identifying kernel struct layout based on brute-force matching. By examining the relationships between kernel structures, common features are extracted and exploited for brute-force matching. The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.