>I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. Not at all - you don't sequentially dump all of kernel space - you

>I feel that exfiltrating memory at a few hundred bytes/sec makes it extremely impractical. Not at all - you don't sequentially dump all of kernel space - you probabilistically sample it and make guesses of where to look next based on the fingerprints you already have seen. It takes not long at all to find useful stuff. Find a block that matches a known library? Ok, that entire section is known. Find a page table? Golden - you quickly walk it and you now know how everything else is laid out. Find any of zillions of known structures? Now you can walk those nicely. I've written code to do kernel reconstruction over the PCI bus from an external security monitor - it's not hard or slow to reconstruct all of memory efficiently and without having to sample much simply by using tricks like these. It's just like playing Battleship, except you can do it much more accurately with perfect knowledge of probabilities.