• Journal of KIISE:Computer Systems and Theory
• /
• v.34 no.12
• /
• pp.618-629
• /
• 2007

In this paper, we propose an effective memory test environment, called a virtualized kernel, for 64bit multi-core computing environments. The term of effectiveness means that we can test all of the physical memory space, even the memory space occupied by the kernel itself, without rebooting. To obtain this capability, our virtualized kernel provides four mechanisms. The first is direct accessing to physical memory both in kernel and user mode, which allows applying various test patterns to any place of physical memory. The second is making kernel virtualized so that we can run two or more kernel image at the different location of physical memory. The third is isolating memory space used by different instances of virtualized kernel. The final is kernel hibernation, which enables the context switch between kernels. We have implemented the proposed virtualized kernel by modifying the latest Linux kernel 2.6.18 running on Intel Xeon system that has two 64bit dual-core CPUs with hyper-threading technology and 2GB main memory. Experimental results have shown that the two instances of virtualized kernel run at the different location of physical memory and the kernel hibernation works well as we have designed. As the results, the every place of physical memory can be tested without rebooting.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.4
• /
• pp.89-100
• /
• 2011

Physical memory analysis has been an issue on a field of live forensic analysis in digital forensics until now. It is very useful to make the result of analysis more reliable, because record of user behavior and data can be founded on physical memory although process is hided. But most memory analysis focuses on windows based system. Because the diversity of target system to be analyzed rises up, it is very important to analyze physical memory based on other OS, not Windows. Mac OS X, has second market share in Operating System, is operated by loading kernel image to physical memory area. In this paper, We propose a methodology for physical memory analysis on Mac OS X using symbol information in kernel image, and acquire a process information, mounted device information, kernel information, kernel extensions(eg. KEXT) and system call entry for detecting system call hooking. In additional to the methodology, we prove that physical memory analysis is very useful though experimental study.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.931-938
• /
• 2013

It is hard to extract original data from encrypted data before getting the password in encrypted data with disk encryption software. This encryption key of disk encryption software can be extract by using physical memory analysis. Searching encryption key time in the physical memory increases with the size of memory because it is intended for whole memory. But physical memory data includes a lot of data that is unrelated to encryption keys like system kernel objects and file data. Therefore, it needs the method that extracts valid data for searching keys by analysis. We provide a method that collect only saved memory parts of disk encrypting keys in physical memory by analyzing Windows kernel virtual address space. We demonstrate superiority because the suggested method experimentally reduces more of the encryption key searching space than the existing method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.71-82
• /
• 2011

Live data in physical memory can be acquired by live forensics but not by harddisk file-system analysis. Therefore, in case of forensic investigation, live forensics is widely used these days. But, existing live forensic methods, that use command line tools in live system, have many weaknesses; for instance, it is not easy to re-analyze and results can be modified by malicious code. For these reasons, in this paper we explain the Windows kernel architecture and how to analyze physical memory dump files to complement weaknesses of traditional live forensics. And then, we design and implement the Physical Memory Dump Explorer, and prove the effectiveness of our tool through test results.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1013-1022
• /
• 2017

Windows hibernation is a function that stores data of physical memory on a non-volatile media and then restores the memory data from the non-volatile media to the physical memory when the system is powered on. Since the hibernation file has memory data in a static state, when the attacker collects it, key information in the system's physical memory may be leaked. Because Windows does not support protection for hibernation files only, we need to protect the memory that is written to the hibernate file. In this paper, we propose a method to encrypt the physical memory data in the hibernation file to protect the memory data of the processes recorded in the hibernation file. Hibernating procedure is analyzed to encrypt the memory data at the hibernating and the encryption process for hibernation memory is implemented to operate transparently for each process. Experimental results show that the hibernation process memory encryption tool showed about 2.7 times overhead due to the crypt cost. This overhead is necessary to prevent the attacker from exposing the plaintext memory data of the process.

• The Journal of Korean Physical Therapy
• /
• v.25 no.3
• /
• pp.132-135
• /
• 2013

We presented with a patient who showed injury of the cingulum and fornix by penetration of a foreign body into the brain on diffusion tensor tractography (DTT). A 63-year-old man suffered a brain injury by a part of a power saw blade that was suddenly detached from a power saw during work. A part of the power saw blade penetrated his right frontal skull and advanced to the right posterior horn of the lateral ventricle. This penetration caused traumatic intracerebral hemorrhage in the right frontal lobe and intraventricular hemorrhage in the lateral ventricle. He underwent craniotomy and removal of intracranial foreign bodies (bony pieces and saw blade). The patient's Memory Assessment Scale scores were 74 (4%ile) for global memory, 78 (7%ile) for verbal memory, and 80 (9%ile) for visual memory. DTTs showed disruptions in the anterior portion of the fornical body, right fornical crus, the anterior portion of the right cingulum, and the middle portion of the left cingulum, compared to the control. It seems that the sustained memory impairment of this patient might be related to injury of the cingulum and fornix.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.5
• /
• pp.861-870
• /
• 2014

According to the intelligence of the malicious code to extract the executable file in physical memory is emerging as an import researh issue. In previous physical memory studies on executable file extraction which is targeting running files, they are not extracted as same as original file saved in disc. Therefore, we need a method that can extract files as same as original one saved in disc and also can analyze file-information loaded in physical memory. In this paper, we provide a method that executable file extraction by analyzing information of Windows kernel file object. Also we analyze the characteristic of physical memory loaded file data from the experiment and we demonstrate superiority because the suggested method can effectively extract more of original file data than the existing method.

• Journal of The Korean Society of Integrative Medicine
• /
• v.12 no.1
• /
• pp.83-96
• /
• 2024

Purpose : This study was conducted to determine the effects of a brain spinning program on cognitive function, body composition, health related fitness and physical self-efficacy of children and adolescents. Methods : This study, 34 children and adolescents were selected and divided into two groups : the exercise group (n=16), which received a brain spinning program and the control group (n=16), which did not receive any exercise program. The program was conducted for 30 minutes three times a week for 4 weeks, and the cognitive function, body composition, health related fitness and physical self-efficacy were measured both before and after the program. Results : The exercise group, which received a brain spinning program showed a significant increase in short-term memory (p<.05) and working memory (p<.01), and muscle mass increased significantly only in the exercise group (p<.05). In addition, left grip strength increased in the exercise group (p<.01), and the maximum oxygen intake decreased significantly only in the control group (p<.05), and Sit-forward bend increased significantly only in the exercise group (p<.01). Physical self-efficacy significantly increased only in the exercise group (p<.05). Conclusion : In summary, short-term memory, cognitive efficiency, working memory, muscle mass, left grip strength, maximum oxygen intake, and left forward bending in children and adolescents significantly increased after the 4-week brain spinning program. However, the control group that was not provided with the 4-week brain spinning program showed a significant increase in body weight and a significant decrease in maximum oxygen intake. In conclusion, the 4-week brain spinning program has positive effects on short-term memory, cognitive function, muscle mass, muscle strength, cardiorespiratory endurance, flexibility, and physical self-efficacy.

• Proceedings of the Korean Powder Metallurgy Institute Conference
• /
• 1998.10b
• /
• pp.7-7
• /
• 1998

Research activities of Russian Medical Engineering Center and Institute of Medical Materials of Shape Memory Alloys and Implants are presented as follows: ${\bullet}$ The direction of elaboration of porous shape memory alloys for medicine. ${\bullet}$ Medical and technical requirements and physical and mechanical criteria of porous shape memory implants elaboration. ${\bullet}$ Basic laws of heat-, stress- and strain-induced changes of mechanical properties, shape memory effect and superelasticity in porous TiNi-based alloys. ${\bullet}$ Methods of regulation of shape memory effect parameters in porous alloys and methods for controlling the regulation-induced changes of physical and mechanical properties. ${\bullet}$ Original technologies of elaboration of porous alloys In various fields of medicine. ${\bullet}$ Arrangement of serial production of shape memory porous implants and examples of their medical use.

• PNF and Movement
• /
• v.6 no.3
• /
• pp.19-28
• /
• 2008

Purpose : The objective of this study was to determine efficacy of sleep-dependent motor learning. Methods : This is a literature study with books and internet. We searched the PubMed, Science Direct, KISS and DBpia. Key words were Sleep-dependent, motor learning, RAM and LTP. Results : Procedural memory, like declarative memory, undergoes a slow, time-dependent period of consolidation. A process has recently been described wherein performance on some procedural task improves with the mere passage of time and has been termed "enhancement". Some studies have reported that the consolidation/enhancement of perceptual and motor skill is dependent on sleep. Specially, rapid-eye-movement(REM) sleep seems to benefit procedural aspects of memory. Conclusion : Motor learning is very important for CNS injury patients. And also distribution of practice sessions is important because REM sleep is to benefit procedural aspects of memory consolidation.