I built LiME from the tarball on the project site (not latest svn) and was able to dump memory successfully (type=lime). After many trials and tribulations I was able to get the Volatility profile built for CentOS 5.3x64 (had to remove pmem from the Makefile). I put the profile in the correct directory, and vol.py --info lists it as expected, however when I try to use the profile with the memory image I get an error.
chort@hydra:~/code/profiles-volatility/CentOS_5.3_x64$ vol.py --profile=LinuxCentOS_5_3x64 -f /fun/ir/geriatrix.lime linux_lsmod
Volatile Systems Volatility Framework 2.3_alpha
WARNING : volatility.obj : Overlay structure cpuinfo_x86 not present in vtypes
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareSnapshotFile: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
JKIA32PagedMemoryPae: No base Address Space
AMD64PagedMemory: No base Address Space
JKIA32PagedMemory: No base Address Space
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
MachOAddressSpace: MachO Header signature invalid
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF64 Header signature invalid
VMWareSnapshotFile: Invalid VMware signature: 0xf000ff53
WindowsCrashDumpSpace32: Header signature invalid
JKIA32PagedMemoryPae: Incompatible profile LinuxCentOS_5_3x64 selected
AMD64PagedMemory: Failed valid Address Space check
JKIA32PagedMemory: Incompatible profile LinuxCentOS_5_3x64 selected
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Incompatible profile LinuxCentOS_5_3x64 selected
On a hunch I checked the directory I built the profile in (copied headers & source from the target system):
chort@hydra:~/code/profiles-volatility/CentOS_5.3_x64$ grep cpuinfo *
System.map-2.6.18-128.el5:ffffffff8006f328 t show_cpuinfo
System.map-2.6.18-128.el5:ffffffff80103251 t cpuinfo_open
System.map-2.6.18-128.el5:ffffffff8020eadb t show_cpuinfo_max_freq
System.map-2.6.18-128.el5:ffffffff8020eafa t show_cpuinfo_min_freq
System.map-2.6.18-128.el5:ffffffff8020f759 t show_cpuinfo_cur_freq
System.map-2.6.18-128.el5:ffffffff802f0bc0 D cpuinfo_op
System.map-2.6.18-128.el5:ffffffff80308420 d proc_cpuinfo_operations
System.map-2.6.18-128.el5:ffffffff803319a0 d cpuinfo_cur_freq
System.map-2.6.18-128.el5:ffffffff80331b20 d cpuinfo_min_freq
System.map-2.6.18-128.el5:ffffffff80331b60 d cpuinfo_max_freq
Platform running Volatility (2.3_alpha, latest from svn):
Linux hydra 3.2.0-35-generic #55-Ubuntu SMP Wed Dec 5 17:42:16 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
Source of memory image:
Linux geriatrix.smtps.net 2.6.18-128.el5 #1 SMP Wed Jan 21 10:41:14 EST 2009 x86_64 x86_64 x86_64 GNU/Linux
What am I missing?
--
chort
Hello again,
So, now that I am using the right profile, the plug ins seem to work.
My goal is recovering unsaved notepad files from hibernation. I have a hiberfil.sys from a Win 7 SP1 64 bit system.
My next step seemed to be using pslist to get the PIDs, and putting those into one of the built in plugins.
I've tried dumpfiles, vaddump, memdump, and some others.
It looks like I should be able to piece something together between the results of dumpfiles with a PID switch, and of vaddump with a PID switch. I haven't figured that out yet. I'm wondering if there is a more specific switch. They both seem to produce a lot more files than I need.
Is there a better way to use volatility's built in tools to pull out files from notepad?
Is there an add on that I can download which will pull out something more quickly and cleanly?
Thanks,
andybellman(a)outlook.com
Hey,
In images (tigger.vmem, sality.vmem and black energy) the connscan plugin gives an output which shows these images are making connection with some IP and also tells the PID of process which are making such connections but when I used PSLIST, PSSCAN and PSXVIEW plugins then none of them shows the process which is having such PID(which is making connection).
P.S: In all the above mentioned images the process id is same i.e. PID=1260
So the problem is why its not showing any detail about PID=1260???
Hi all,
In my continuing exploration of Windows memory and Volatility I'm current looking at Windows, literally, the GUI.
Looking at a notepad process, wintree shows me:
.Untitled - Notepad (visible) notepad.exe:100 Notepad
..#20128 notepad.exe:100 6.0.7601.17514!msctls_statusbar32
..#20126 (visible) notepad.exe:100 6.0.7601.17514!Edit
.Default IME notepad.exe:100 IME
.MSCTFIME UI notepad.exe:100 MSCTFIME UI
So, I'm assuming #20128 is the status bar at the bottom of the Notepad window, and #20126 is the edit control, that is, the textarea into which the user types.
This is the corresponding output from the windows plugin for the edit control:
Window Handle: #20126 at 0xfea0dc70, Name:
ClassAtom: 0xc119, Class: 6.0.7601.17514!Edit
SuperClassAtom: 0xc018, SuperClass: Edit
pti: 0xfe2a4008, Tid: 1692 at 0x8550d368
ppi: 0xffa95550, Process: notepad.exe, Pid: 100
Visible: Yes
Left: 10, Top: 52, Bottom: 485, Right: 701
Style Flags: WS_VSCROLL,WS_CHILD,WS_OVERLAPPED,WS_VISIBLE,WS_HSCROLL
ExStyle Flags: WS_EX_CLIENTEDGE,WS_EX_LTRREADING,WS_EX_RIGHTSCROLLBAR,WS_EX_LEFT
Window procedure: 0x744399d0
Question 1:
Window Handle: #20126 at 0xfea0dc70 - what is the offset? Physical, virtual? Of what? The Edit control object?
(I'm guessing: physical, yes, of the edit control object.)
Question 2:
I can see that it's Window-esque properties (X, Y, width, height, style flags, et al) are all clearly present., but where can I find information specific to this control (in this instance, an 'Edit'). For example, maybe the text it contains?
(I'm guessing, take a look at 0xfea0dc70 and there'll be some kind of structure to parse.)
As always, many thanks. (This is all going towards a plugin that I'm hoping to write!)
Also as always, if I could've found this information on my own, please let me know where to look.
I've read the Command Reference and the associated MoVP posts.
Adam
Hello guys,
I'm trying to use Volatility through Firewire, but actually it's not
working.
My investigator PC runs Ubuntu Linux Ubuntu 12.04
I'm using the New (JuJu) Firewire stack compiled into kernel and I also
installed forensic1394.
My Firewire Bus is up and connected to a Firewire Bus on a target win7
system (4GB memory),
I can successfully dump the memory with another tool called 'inception'.
However, output only says:
vol# python vol.py -l firewire://forensic1394/0 --profile=Win7SP1x64 modules
Volatility Foundation Volatility Framework 2.3.1
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareSnapshotFile: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
FileAddressSpace: Location is not of file scheme
ArmAddressSpace: No base Address Space
What I am doing wrong?
Thank you!
--
Sebastian
Hello Jamie,
Apologies for delayed response. Had a short break with family.
I tried using dumpfiles plugins as per your adviced. it turned out working against winxp, but seems not against win7sp1x86. is this a known limitation?
Thanks again mate.
Regards,
Roger
On Feb 18, 2014, at 5:00 AM, vol-users-request(a)volatilityfoundation.org wrote:
> Send Vol-users mailing list submissions to
> vol-users(a)volatilityfoundation.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
> or, via email, send a message with subject or body 'help' to
> vol-users-request(a)volatilityfoundation.org
>
> You can reach the person managing the list at
> vol-users-owner(a)volatilityfoundation.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Vol-users digest..."
>
>
> Today's Topics:
>
> 1. dumping registry hive(s) from memory image (Roger)
> 2. Re: dumping registry hive(s) from memory image (Jamie Levy)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 17 Feb 2014 16:53:01 +1100
> From: Roger <roger.franklin67(a)gmail.com>
> Subject: [Vol-users] dumping registry hive(s) from memory image
> To: "vol-users(a)volatilityfoundation.org" <vol-users(a)volatilityfoundation.org>
> Message-ID: <98444CAC-D5F0-473B-88EB-75CC983F2869(a)gmail.com>
> Content-Type: text/plain; charset=us-ascii
>
> I've been trying to get/dump a copy of a certain registry hive from the memory. Managed to list down their offsets using hivelist plugin but unable to find ways of dumping them to files. My intention is to load it to other tools such as regripper as input/target registry files.
>
> Has any one found a way of doing it?
>
> Thank you very much in advance.
>
> Kind regards,
> Roger
>
> ------------------------------
>
> Message: 2
> Date: Mon, 17 Feb 2014 10:22:32 -0500
> From: Jamie Levy <jamie.levy(a)gmail.com>
> Subject: Re: [Vol-users] dumping registry hive(s) from memory image
> To: vol-users(a)volatilityfoundation.org
> Message-ID: <53022938.4040302(a)gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hi Roger,
>
> Try using the dumpfiles plugin:
>
> http://code.google.com/p/volatility/wiki/CommandReference23#dumpfiles
>
> You can use an example similar to the event logs one in order to dump
> the registry file. Let me know if you need help.
>
> All the best,
>
> -Jamie
>
>
>
> On 2/17/2014 12:53 AM, Roger wrote:
>> I've been trying to get/dump a copy of a certain registry hive from the memory. Managed to list down their offsets using hivelist plugin but unable to find ways of dumping them to files. My intention is to load it to other tools such as regripper as input/target registry files.
>>
>> Has any one found a way of doing it?
>>
>> Thank you very much in advance.
>>
>> Kind regards,
>> Roger_______________________________________________
>> Vol-users mailing list
>> Vol-users(a)volatilityfoundation.org
>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
> --
> Jamie Levy (@gleeda)
> Blog: http://volatility-labs.blogspot.com/
> GPG: http://pgp.mit.edu/pks/lookup?op=get&search=0x196B2AB527A4AC92
> Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92
>
>
> ------------------------------
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
>
> End of Vol-users Digest, Vol 68, Issue 6
> ****************************************
