Memory Extraction of an Emulated STM-32 Blue Pill for Anomaly Detection

The deployment of embedded devices throughout various disciplines continues to grow at a rapid rate. Protecting these devices from attacks requires innovative approaches to determine anomalous behaviors. A proposed approach is to utilize the device’s global memory pattern to detect suspicious device activity. Memory extraction is used in various fields, such as digital forensics and cybersecurity, to gather information about the processes running on the device. Physical memory extraction can be challenging due to the time-consuming nature of pausing the device to dump its memory successfully. Through device emulation, we can rapidly deploy and test various cybersecurity techniques. We can obtain the desired data in real-time using emulated memory extraction. In this paper, we demonstrate the ability to achieve memory extraction of a QEMU emulated STM-32 Blue Pill using the GDB RSP protocol. The advantages and significance of bulk memory extraction from an emulated device for anomaly detection are examined.