Reproduce “Bringing Forensic Readiness to Modern Computer Firmware” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Tobias Latzo, Florian Hantke, Lukas Kotschi, Felix Freiling
Researchers at Friedrich-Alexander-Universität Erlangen-Nürnberg developed UEberForensIcs, a UEFI application that enables cold boot memory acquisition directly from firmware, and demonstrated persistent code execution in UEFI Runtime Services for live forensics. Their methods acquire memory with minimal impact on critical regions and provide insights into operating system-firmware interactions, enhancing forensic readiness.
Key insights
- Forensic capabilities can be effectively embedded directly into modern UEFI firmware, enhancing resilience against anti-forensic techniques.
- Memory acquisition performed by firmware after a system reboot causes limited memory changes (approximately 30-32 MiB on a 2 GiB system), primarily at memory map borders, preserving the majority of core memory contents.
- UEFI Runtime Services can be hooked to allow arbitrary, stealthy code execution with kernel privileges during operating system runtime, opening avenues for live forensic acquisition without OS kernel modification.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.