Windows Memory Analysis Based on KPCR

摘要

This paper briefiy introduces the challenges facing collection of volatile data in a target computer. Resons to favor physical memory analysis are also given. After describing the related work of the memory analysis, details of a windows memory analysing method are given through which it is possible to extract useful information, such as running processes, current network connections, file contents, etc., from a memory image. The method is based on a data structure in windows known as Kernel Processor Control Region, or KPCR. Besides, details of address translation from virtual address to physical address are thoroughly discussed and an algorithm of address translation for practice is given. This method is verified on Windows XP SP2, Windows 2003 Server SP2 and Windows Vista Home Basic.