• Design of a hardware architecture for high-speed volatile memory acquisition and real-time forensic artifact scanning on FPGA devices. • Development of an efficient FPGA-based method for detecting active and terminated processes on Windows 10 through direct physical memory scanning. • Proof-of-concept evaluation demonstrating significant speed improvements over traditional forensic tools. • Analysis of system limitations and applicability in both laboratory and real-world environments. Modern malware often employs anti-analysis techniques to detect virtualized or emulated environments, evading traditional dynamic analysis systems. To address this challenge, bare-metal analysis platforms have emerged as a more transparent alternative. However, efficiently monitoring them while preserving transparency and minimizing interference remains a key challenge. In this paper, we present a proof-of-concept hardware accelerator implemented on an FPGA device, designed for high-speed volatile memory acquisition and on-the-fly pool tag scanning of the memory content to extract information about active and terminated processes on a bare-metal malware execution system running Windows 10. The memory forensics accelerator leverages PCIe-based DMA to acquire the volatile memory from the monitored system and performs the scanning for process structures directly on the FPGA, without requiring any software installation on the monitored system. Our approach improves transparency and isolation, and shows significant speed advantages over conventional snapshot-based memory forensics. We evaluate the prototype and discuss its limitations and applicability in malware analysis workflows.

Malicious applications, malware, continue to be a major security threat for computer systems. Due to the fast growing number and increasing complexity of malware, manual analysis became impractical and automated methods are preferred by security analysts. The automated dynamic analysis of malware executes the samples in controlled environments and monitors the execution for potentially malicious behavior. The vulnerability of this method is that modern malware detect these emulated or virtualized environments and suspend their malicious activities to foil the analysis. However, the malware exhibit a semantically different behavior when running directly on computer system hardware, i.e. bare-metal systems. Consequently, the ultimate technique for analyzing the behavior of malware is through execution of the samples in bare-metal analysis environments. Nevertheless, restoring the system to a clean state after each sample analysis is challenging. In order to restore the storage device state of a bare-metal system to a clean state, in this paper we propose an FPGA-implemented storage mirroring technique for instantaneous restoration of the storage device and, optionally, the retrieval of the files having been modified during the sample execution. The FPGA-based system can be integrated in commodity computer systems with Serial ATA storage devices. The retrieval of modified files is supported for systems running Windows operating systems with NTFS file-system. The experimental results demonstrate the viability of the solution.

An increasing number of high performance computing applications developed on reconfigurable platforms require access to mass storage devices for storing a large amount of data. The multi-gigabit transceivers integrated in FPGA devices allow the development of a wide range of communication protocols. The Serial ATA protocol provides a solution for accessing mass storage devices at high transfer rates. This paper describes the design and implementation of Serial ATA Gen3 Host and Device controllers on Xilinx 7-Series FPGA devices to facilitate the access of high performance and embedded applications to non-volatile storage devices, e.g. hard disk drives and solid state drives. The controllers can interface with commodity Serial ATA Gen3 storage devices and host bus adapters at a data transfer rate of 6.0 Gbps. For an increased performance, both Host and Device controllers support the Native Command Queueing (NCQ) feature set, in addition to the regular read and write commands. The experimental results demonstrate the viability of the Serial ATA Gen3 controllers and prove a sustained throughput close to the maximum theoretical data transfer rates of the Serial ATA protocol, thus having the potential of being an important building block of complex systems targeting a wide range of applications.