Dumping memory using SMM
Using System Management Mode for dumping memory
Following up on SMM:
- It’s a good place for persistence
- Turns out it’s also a good place for dumping memory!
- You’ve got access to all memory (The paper says only 4GB, unsure why they didn’t swap to long mode?)
- Added bonus: CPU isn’t executing other code, so nothing is going to change while you’re reading it
No idea where this went - The author didn’t seem to publish anything further on the matter (https://www.artificialstudios.org/alessandro.reina/pubs.html).
https://www.artificialstudios.org/alessandro.reina/pubs/acsac12-lecture.pdf