利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

8 条记录 (耗时 0.015 秒)

    System and method for forensic identification of elements within a computer system
    1.
    发明授权
    System and method for forensic identification of elements within a computer system 有权
    计算机系统中元素的法医识别系统和方法

    公开(公告)号：US08881271B2

    公开(公告)日：2014-11-04

    申请号：US12184898

    申请日：2008-08-01

    申请人： James Robert Butler, II

    发明人： James Robert Butler, II

    IPC分类号： G06F12/14 ,  H04L29/06 ,  H04L9/32 ,  G06F9/44 ,  G06F21/57

    CPC分类号： G06F21/577

    摘要： A system and method for employing memory forensic techniques to determine operating system type, memory management configuration, and virtual machine status on a running computer system. The techniques apply advanced techniques in a fashion to make them usable and accessible by Information Technology professionals that may not necessarily be versed in the specifics of memory forensic methodologies and theory.

    摘要翻译： 一种使用存储器取证技术来确定运行的计算机系统上的操作系统类型，存储器管理配置和虚拟机状态的系统和方法。 这些技术以一种方式应用先进技术，使其可以被信息技术专业人员使用和访问，这些专业人士可能不一定熟悉记忆法证方法和理论的细节。

    System to bypass a compromised mass storage device driver stack and method thereof
    2.
    发明授权
    System to bypass a compromised mass storage device driver stack and method thereof 有权
    绕过受损的大容量存储设备驱动程序堆栈的系统及其方法

    公开(公告)号：US09275229B2

    公开(公告)日：2016-03-01

    申请号：US13421843

    申请日：2012-03-15

    申请人： Aaron LeMasters

    发明人： Aaron LeMasters

    IPC分类号： G06F11/00 ,  G06F21/57

    CPC分类号： G06F21/572 ,  G06F21/568 ,  G06F21/85 ,  G06F2221/033

    摘要： A method to circumvent malicious software via a system configured to bypass a device driver stack and, consequently, also bypass the malicious software that may be adversely affecting the device driver stack by using an alternative stack such as a crash dump I/O stack. The crash dump I/O stack is poorly documented relative to the device driver stack and functions independently from the device driver stack.

    摘要翻译： 通过配置为绕过设备驱动程序堆栈的系统来绕过恶意软件的方法，并因此也绕过可能通过使用替代堆栈（如崩溃转储I / O堆栈）而对设备驱动程序堆栈产生不利影响的恶意软件。 崩溃转储I / O堆栈相对于设备驱动程序堆栈的记录不良，并且独立于设备驱动程序堆栈。

    Physical memory forensics system and method
    5.
    发明授权
    Physical memory forensics system and method 有权
    物理内存取证系统及方法

    公开(公告)号：US09268936B2

    公开(公告)日：2016-02-23

    申请号：US13560415

    申请日：2012-07-27

    申请人： James Butler

    发明人： James Butler

    IPC分类号： G06F12/10 ,  G06F21/55 ,  G06F21/64

    CPC分类号： G06F21/554 ,  G06F12/10 ,  G06F21/64

    摘要： The method of the present inventive concept is configured to utilize Operating System data structures related to memory-mapped binaries to reconstruct processes. These structures provide a system configured to facilitate the acquisition of data that traditional memory analysis tools fail to identify, including by providing a system configured to traverse a virtual address descriptor, determine a pointer to a control area, traverse a PPTE array, copy binary data identified in the PPTE array, generate markers to determine whether the binary data is compromised, and utilize the binary data to reconstruct a process.

    摘要翻译： 本发明构思的方法被配置为利用与存储器映射二进制文件相关的操作系统数据结构来重构进程。 这些结构提供了一种系统，其被配置为便于采集传统存储器分析工具无法识别的数据，包括通过提供被配置为遍历虚拟地址描述符的系统，确定到控制区域的指针，遍历PPTE阵列，复制二进制数据 在PPTE数组中识别，生成标记以确定二进制数据是否受到损害，并利用二进制数据来重构进程。

    System and method for detecting executable machine instructions in a data stream
    7.
    发明授权
    System and method for detecting executable machine instructions in a data stream 有权
    用于检测数据流中的可执行机器指令的系统和方法

    公开(公告)号：US08713681B2

    公开(公告)日：2014-04-29

    申请号：US12607055

    申请日：2009-10-27

    申请人： Peter J. Silberman ,  James R. Butler, II ,  Nick J. Harbour

    发明人： Peter J. Silberman ,  James R. Butler, II ,  Nick J. Harbour

    IPC分类号： G06F12/14 ,  H04L29/06 ,  H04L9/32

    CPC分类号： G06F21/562 ,  G06F21/56 ,  G06F2221/033

    摘要： Detecting executable machine instructions in a data is accomplished by accessing a plurality of values representing data contained within a memory of a computer system and performing pre-processing on the plurality of values to produce a candidate data subset. The pre-processing may include determining whether the plurality of values meets (a) a randomness condition, (b) a length condition, and/or (c) a string ratio condition. The candidate data subset is inspected for computer instructions, characteristics of the computer instructions are determined, and a predetermined action taken based on the characteristics of the computer instructions.

    摘要翻译： 检测数据中的可执行机器指令是通过访问表示计算机系统的存储器内的数据的多个值来完成的，并且对多个值执行预处理以产生候选数据子集。 预处理可以包括确定多个值是否满足（a）随机条件，（b）长度条件和/或（c）字符串比率条件。 对候选数据子集进行计算机指令的检查，确定计算机指令的特性，并根据计算机指令的特性进行预定的动作。