tregua87 / sgx-forensic

Collection of tools to perform memory analysis of machine SGX-enabled

SGX MEMORY FORENSIC PROJECT

This project collects a set of tools for performing forensic memory analysis of SGX enclaves.

The project is structured as follow:

• LiME for SGX machines: ./lime contains a custom LiME version that traverses and dumps the SGX enclaves structure allocated by the kernel. Moreover, the tool attempts at donwloading the encalve page content if they are in DEBUG mode. The project handles the two Intel SGX driver released so far (i.e., isgx and DCAP).
• Volatility Overlay Utilities: ./volatility-module contains the tools to create a Volatility Profile enabled to inspect the SGX encalve structures allocated at kernel side.
• Volatility SGX Plugin: ./volatility-plugin contains a volatility plugin that analysis the enclave memory layout, extracts the ECALL/OCALL/ECREATE, and provides other forensic information.
• Replicate Paper's Result: EXPERIMENT.md an installation guide to replicate the experiments in the paper.

The project is maintained by:

• Flavio Toffalini (https://github.com/tregua87)
• Andrea Oliveri (https://github.com/IridiumXOR/)