An open API service indexing awesome lists of open source software.

https://github.com/tregua87/sgx-forensic

Collection of tools to perform memory analysis of machine SGX-enabled
https://github.com/tregua87/sgx-forensic

Last synced: about 1 month ago
JSON representation

Collection of tools to perform memory analysis of machine SGX-enabled

Awesome Lists containing this project

README

        

# SGX MEMORY FORENSIC PROJECT

This project collects a set of tools for performing forensic memory analysis of SGX enclaves.

The project is structured as follow:
- [LiME for SGX machines](./lime): `./lime` contains a custom LiME version that traverses and dumps the SGX enclaves structure allocated by the kernel. Moreover, the tool attempts at donwloading the encalve page content if they are in DEBUG mode. The project handles the two Intel SGX driver released so far (i.e., isgx and DCAP).
- [Volatility Overlay Utilities](./volatility-module): `./volatility-module` contains the tools to create a Volatility Profile enabled to inspect the SGX encalve structures allocated at kernel side.
- [Volatility SGX Plugin](./volatility-plugin): `./volatility-plugin` contains a volatility plugin that analysis the enclave memory layout, extracts the ECALL/OCALL/ECREATE, and provides other forensic information.
- [Replicate Paper's Result](./EXPERIMENT.md): `EXPERIMENT.md` an installation guide to replicate the experiments in the paper.

The project is maintained by:
- Flavio Toffalini (https://github.com/tregua87)
- Andrea Oliveri (https://github.com/IridiumXOR/)