Vol-users May 2009

vol-users@lists.volatilityfoundation.org

8 participants
4 discussions

Volatility Plug-in for IAT/EAT/Inline Hook Detection

by AAron Walters

http://mnin.blogspot.com/2009/05/volatility-plug-in-for-iateatinline.html Michael Hale Ligh has created another new Volatility plugin for malware analysts. This plug-in called usermode_hooks.py can be used to detect IAT/EAT/Inline rootkit hooks in usermode processes. I'm sure he would appreciate testing help and any feedback you are able to provide. Shouts to MHL! Thanks, AW

14 years, 6 months

Re: [Vol-users] Volatility's Network Connections

by david＠sharpebusinesssolutions.com

I concur with your point about needing to use all three tools. Each has its own strengths and weaknesses. I use HBGary Responder Pro primarily and fall over to Volatility or Mandiant Memoryze when I come across something HBGary can't do (or I don't know how to do in HBGary). To your point about analyzing network connections, I have recently observed cases where Volatility "connections" produces no output at all and HBGary does. In that situation Volatility "connscan" does find connections, but the lists doesn't 100% match HBGary. I am also a little concerned about what appears to me to be a drop in development activity around Volatility. Is Mandiant Memoryze going to take over the top slot? Right now, I see Mandiant Memoryze as third best behind HBGary and Volatility, but Volatility can't stand still. For example, does anyone know if there any plans to provide functionaility similar to HBGary's new Digital DNA in Volatility? If anyone wants to share information or experiences across all three applications or memory dump analysis in general, feel free to contact me at david(a)sharpebusinesssolutions.com. -- David --- cutaway(a)cutawaysecurity.com wrote: From: "Don C. Weber" <cutaway(a)cutawaysecurity.com> To: vol-users(a)volatilesystems.com Subject: [Vol-users] Volatility's Network Connections Date: Wed, 6 May 2009 08:48:47 -0500 I wanted to let you know that while using Volatility and several other memory analysis tools I received some conflicting information associated with network connections. I did a quick blog post on the subject that can be read here: http://www.cutawaysecurity.com/blog/archives/523 . It looks like Volatility shows more information than the others in some instances. Also, if you have additional information or detail on this please post a comment or let me know so that I can add an update to the post. -- -------------------------- Don C. Weber Information Security Consultant Cutaway Security CISSP, GIAC ######################################### Website: http://www.cutawaysecurity.com _______________________________________________ Vol-users mailing list Vol-users(a)volatilesystems.com http://lists.volatilesystems.com/mailman/listinfo/vol-users

14 years, 7 months

Re: [Vol-users] Volatility's Network Connections

by david＠sharpebusinesssolutions.com

The Volatility connscan and connscan2 output are identical byte-for-byte against the dump I am talking about. "Connections" terminates gracefully with no console output in tcb_connections in network.py after having trouble locating the right data structure to walk in my dump file. Thank you for taking the time to respond. I wasn't really asking for help with anything in my initial reply to this thread. I was just trying to support the original author's assertion that there are differences between the various commercial and non-commercial solutions in the Windows memory dump analysis space. In my view, all three that I personally have experience with so far: Volatility, HBGary Responder, and Mandiant Memoryze all have their own strengths and weaknesses. I see this space just like hard drive or mobile device forensics - each of the leading vendors has their strong points and sometimes you need to combine the results of multiple tools to get the best results. -- David --- taosecurity(a)gmail.com wrote: From: Richard Bejtlich <taosecurity(a)gmail.com> To: david(a)sharpebusinesssolutions.com Cc: "Don C. Weber" <cutaway(a)cutawaysecurity.com>, vol-users(a)volatilesystems.com Subject: Re: [Vol-users] Volatility's Network Connections Date: Mon, 11 May 2009 10:15:48 -0400 On Thu, May 7, 2009 at 10:12 AM, <david(a)sharpebusinesssolutions.com> wrote: > > > I concur with your point about needing to use all three tools. Each has its own strengths and weaknesses. I use HBGary Responder Pro primarily and fall over to Volatility or Mandiant Memoryze when I come across something HBGary can't do (or I don't know how to do in HBGary). > > To your point about analyzing network connections, I have recently observed cases where Volatility "connections" produces no output at all and HBGary does. In that situation Volatility "connscan" does find connections, but the lists doesn't 100% match HBGary. > Hi David, When you say "connscan", have you also used "connscan2"? Thank you, Richard _______________________________________________ Vol-users mailing list Vol-users(a)volatilesystems.com http://lists.volatilesystems.com/mailman/listinfo/vol-users

14 years, 7 months

Volatility's Network Connections

by Don C. Weber

I wanted to let you know that while using Volatility and several other memory analysis tools I received some conflicting information associated with network connections. I did a quick blog post on the subject that can be read here: http://www.cutawaysecurity.com/blog/archives/523 . It looks like Volatility shows more information than the others in some instances. Also, if you have additional information or detail on this please post a comment or let me know so that I can add an update to the post. -- -------------------------- Don C. Weber Information Security Consultant Cutaway Security CISSP, GIAC ######################################### Website: http://www.cutawaysecurity.com

14 years, 7 months

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-users May 2009