MMUShell OS-Agnostic Memory Forensics Tool
Proof of concept for techniques developed by Andrea Oliveri and Davide Balzarotti in
"In the Land of MMUs: Multiarchitecture OS-Agnostic Virtual Memory Forensics"
Installation:
pip install -r requirements.txt
Usage:
- Dump all the RAM areas of the machine that you want to analyze in raw format, one file per physical memory area.
- Create a YAML file describing the hardware configuration of the machine (see the examples available in the dataset).
mmushell machine.yaml- Use the interactive shell to find MMU registers, Radix-Trees, Hash tables etc. and explore them. The
helpcommand lists all the possible actions available for the selected CPU architecture. - Here part of the dataset containing the memory dumps of the OSs used in the paper (only the open-source ones, due to license restrictions).
/qemu/contains the patch for QEMU 5.0.0 in order to collect the ground truth values of the MMU registers during OSs execution.