浏览器隐私模式下进程内存数据快速获取方法

浏览器隐私模式使得用户浏览行为的取证调查变得困难,相关证据只能来自于内存。提出一种获取活动进程内存空间的方法,通过使用目标进程的CR3寄存器的内容替换当前进程的CR3寄存器的内容,使当前进程可获取目标进程的页目录和页表等信息,进而访问并获取目标进程内存空间。相对于先对内存进行完整镜像再获取目标进程数据空间的方法,缩小了下一步对用户浏览行为进行分析所涉及的数据范围,获取进程内存空间数据的速度更快。该方法也适用于目标明确的单个或几个其他进程的内存数据获取。

Fast access to process memory data in private browser mode

Private browsing mode makes it difficult to take evidence because people have to get evidence from memory.This paper presented a method to acquire the space of active processes memory.Through replacing the content in the CR3 registers of the current process with the one in the CR3 registers of the target process,the current process can obtain the page directories and the page tables of the target process and it is possible that current process can access and acquire the memory space of the target process.Compared with imaging the physical memory and then obtaining the memory space of target process,the new method limits the data scope of analyzing users’ browsing behavior in next setup and accesses to the memory space of process much faster.The method is also applicative for the acquisition of specific processes memory data in other cases.