Loading…
Academic Journal
Reading the contents of deleted and modified files in the virtualization based black-box binary analysis system Drakvuf
S. G. Kovalev
Труды Института системного программирования РАН, Vol 30, Iss 5, Pp 109-122 (2018)
Saved in:
| Title | Reading the contents of deleted and modified files in the virtualization based black-box binary analysis system Drakvuf |
|---|---|
| Authors | S. G. Kovalev |
| Publication Year |
2018
|
| Source |
Труды Института системного программирования РАН, Vol 30, Iss 5, Pp 109-122 (2018)
|
| Description |
The article discusses ways to get the content of files, which are modified during the processing in the well-known open source dynamic analysis environment Drakvuf. Drakvuf initially implemented file saving functionality based on the use of undocumented mechanisms for working with the system cache. The author of this article proposes a new approach to obtaining the content of files on Microsoft Windows family systems using Drakvuf. The proposed approach is based solely on the use of the public interface of the kernel by the hypervisor and provides portability between different versions of the operating system. In the conclusion of the article, the advantages and disadvantages of both approaches are presented, and directions for further work are proposed.
|
| Document Type |
article
|
| Language |
English
Russian |
| Publisher Information |
Ivannikov Institute for System Programming of the Russian Academy of Sciences, 2018.
|
| Subject Terms | |
