Using a software exploit to image RAM on an embedded system

  • Authors:
  • J. R. Rabaiotti;C. J. Hargreaves

  • Affiliations:
  • Centre for Forensic Computing and Security, Cranfield University, Shrivenham, UK;Centre for Forensic Computing and Security, Cranfield University, Shrivenham, UK

  • Venue:
  • Digital Investigation: The International Journal of Digital Forensics & Incident Response
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

The research in this paper is the result of a court case involving copyright infringement, specifically, a request for expert evidence regarding the proportion of copyrighted data present in the RAM of a games console. This paper presents a novel method to image the memory of an embedded device (a games console) where normal software and hardware memory imaging techniques are not possible. The paper describes how a buffer overflow exploit can be used in order to execute custom code written to create an image of the console's memory. While this work is concerned with the Microsoft Xbox, the principles of vulnerability enabled data acquisition could be extended to other embedded devices, including other consoles, smart phones and PDAs.