Object Scanning of Windows Kernel Driver Based on Pool Tag Quick Scanning

基于内存池标记快速扫描技术的Windows内核驱动对象扫描

School of Computer Science and Technology, Harbin University of Science and Technology, Harbin 150080, China

Received: 22 October 2018

Abstract

In the memory forensics, the Pool Tag Scanning based on the memory pool tag requires a detailed search of the physical memory when scanning the kernel driver object, which is very inefficient. The object scanning of Windows kernel driver by using the pool tag quick scanning is proposed. The method uses the quick pool tag scanning to reduce the memory range of the scan, and then scan the driver object according to the characteristics of the kernel driver object quickly, to help investigator to determine whether the driver is normal. Experimental results shows that the scanning efficiency for object scanning of kernel driver is improved greatly by using the quick pool tag scanning technology and the time spent in the scanning step is reduced while ensuring the false alarm rate is same.

摘要

计算机内存取证领域中，基于内存池标记的池标记扫描技术在对内核驱动对象进行扫描时需要对全部物理内存进行详尽搜索，效率很低。提出了一种使用内存池标记快速扫描技术扫描Windows内核驱动对象的方法。该方法采用内存池标记快速扫描技术，减小扫描的内存范围，然后根据内核驱动对象特征对驱动对象进行快速扫描，以帮助调查人员判断驱动是否存在异常。实验表明，使用内存池标记快速扫描技术进行内核驱动对象扫描可以在保证误报率不变的情况下，极大地提高扫描效率，减少在扫描步骤花费的时间。