- Vol-users - volatilityfoundation.org

OMFW 2014 Update & Dr. Brendan Dolan-Gavitt

by AAron Walters

vol-users, We are excited to announce that over half the seats for the Open Memory Forensics Workshop (OMFW) 2014 have already been reserved. It’s also great to see a large number of first time attendees from across government, academic, and commercial institutions. This is your one chance a year to hear about the latest research in memory forensics from the people who are pioneering the field. If you are still planning to attend, we suggest you register as soon as possible to make sure you have a seat. We are also excited to announce that Dr. Brendan Dolan Gavitt (moyix) will be speaking at the workshop. As many of you know, Brendan has been a member of the Volatility family since the very beginning and recently earned his PhD from the Georgia Institute of Technology. If you have followed Brendan’s work throughout the years and his new research with PANDA, I’m sure you will not be disappointed. In the upcoming weeks, we will continue finalizing and announcing the exciting roster of speakers. http://volatility.tumblr.com/post/97219909222/omfw-2014-update-dr-brendan-d… AW

10 years, 9 months

1
0
0 0

Having issues with linux profile -- please help

by Josh Horowitz

Dear Vol-users: First and foremost thanks to the creators of volatility for this amazing tool. I've been struggling to create a proper linux profile to analyze a memory dump from an Ubuntu 12.04.3 LTS machine created with fmem. The dump was split into several files which I combined using cat. I don't have access to the physical machine just some snapshot info, and have been trying to gather all the information I need in order to create the proper profile as follows: I grepped through /var/log/kern.log to find the kernel version that was running and got this: Linux version 3.2.0-53-generic (buildd@allspice) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #81-Ubuntu SMP Thu Aug 22 21:01:03 UTC 2013 (Ubuntu 3.2.0-53.81-generic 3.2.50) Also grep through kern.log for CPU and get: CPU0: Intel(R) Core(TM) i7-2675QM CPU @ 2.20GHz stepping 07 -- which I know to utilize 64-bit architecture. So to create the profile, I've installed a virtual machine running Ubuntu 12.04.3X64 and the identical kernel version: 3.2.0-53-generic. I have a different processor core on the virtual machine Im using to build the profile (Intel i5-4288U @ 2.60 GHZ, perhaps this is part of the problem?) I followed the instructions to a T on generating modules.dwarf using the included volatility toolset, copying the Systems.map file, zipping them together, etc. Run the required python vol.py --info | grep Linux Volatility Foundation Volatility Framework 2.4 Linux3_2_0-52-genericX_64x64 - A Profile for Linux 3.2.0-52-genericX_64 x64 Linux4cpuprofilex64 - A Profile for Linux 4cpuprofile x64 LinuxUbuntu12_04_3x86 - A Profile for Linux Ubuntu12_04_3 x86 LinuxUbuntu_12_04_3_X64x64 - A Profile for Linux Ubuntu_12_04_3_X64 x64 Linuxkernel-3_2_0-52-genericx86 - A Profile for Linux kernel-3.2.0-52-generic x86 and all seems well. (The LinuxUbuntu_12_04_3_X64x64 is for kernel 3.2.0-53-generic) Now when I run the following with -dd flag for debug I get the following (Sorry for length of debug msg) python vol.py -f memdump.dd --profile=LinuxUbuntu_12_04_3_X64x64 -dd linux_pslist Volatility Foundation Volatility Framework 2.4 DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu_12_04_3_X64: Found dwarf file System.map-3.2.0-53-generic with 573 symbols DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu_12_04_3_X64: Found system file System.map-3.2.0-53-generic with 1 symbols DEBUG : volatility.obj : Applying modification from BashHashTypes DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF32Modification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from ELFModification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from LinuxTruecryptModification DEBUG : volatility.obj : Applying modification from MachoModification DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxIntelOverlay DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu_12_04_3_X64: Found dwarf file System.map-3.2.0-53-generic with 573 symbols DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu_12_04_3_X64: Found system file System.map-3.2.0-53-generic with 1 symbols DEBUG : volatility.obj : Applying modification from BashHashTypes DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF32Modification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from ELFModification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from LinuxTruecryptModification DEBUG : volatility.obj : Applying modification from MachoModification DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxIntelOverlay DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay Offset Name Pid Uid Gid DTB Start Time ------------------ -------------------- --------------- --------------- ------ ------------------ ---------- DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: mac: need base DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: lime: need base DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64BitMap: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating VMWareMetaAddressSpace: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating VMWareAddressSpace: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> DEBUG1 : volatility.utils : Failed instantiating QemuCoreDumpElf: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> DEBUG1 : volatility.utils : Failed instantiating OSXPmemELF: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0x7fe1d90> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header signature DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64BitMap: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating VMWareMetaAddressSpace: VMware metadata file is not available DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic found DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating VMWareAddressSpace: Invalid VMware signature: 0xffffffff DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> DEBUG1 : volatility.utils : Failed instantiating QemuCoreDumpElf: ELF Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xfffff8104eff0L DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: Failed valid Address Space check DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: Incompatible profile LinuxUbuntu_12_04_3_X64x64 selected DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: Incompatible profile LinuxUbuntu_12_04_3_X64x64 selected DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> DEBUG1 : volatility.utils : Failed instantiating OSXPmemELF: ELF Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating FileAddressSpace: Must be first Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> DEBUG1 : volatility.obj : None object instantiated: Could not read_long_phys at offset 0x3ffffffff070L DEBUG1 : volatility.obj : None object instantiated: Could not read_long_phys at offset 0x3ffffffff040L DEBUG1 : volatility.obj : None object instantiated: No suggestions available DEBUG1 : volatility.utils : Failed instantiating ArmAddressSpace: Failed valid Address Space check No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64BitMap: No base Address Space VMWareMetaAddressSpace: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareAddressSpace: No base Address Space QemuCoreDumpElf: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space OSXPmemELF: No base Address Space MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64BitMap: Header signature invalid VMWareMetaAddressSpace: VMware metadata file is not available WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF Header signature invalid VMWareAddressSpace: Invalid VMware signature: 0xffffffff QemuCoreDumpElf: ELF Header signature invalid WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Failed valid Address Space check IA32PagedMemoryPae: Incompatible profile LinuxUbuntu_12_04_3_X64x64 selected IA32PagedMemory: Incompatible profile LinuxUbuntu_12_04_3_X64x64 selected OSXPmemELF: ELF Header signature invalid FileAddressSpace: Must be first Address Space ArmAddressSpace: Failed valid Address Space check The error must have something to do with the way that I'm generating the profile (at least I think something is off) but I can't for the life of me figure out what the problem is. I truly appreciate any light that a vol expert out there may able to shed on what I need to do differently. Thanks very much.

10 years, 9 months

2
5
0 0

zeusscan

by Bridgey theGeek

(I definitely have the reply I sent hours ago in my 'Sent Items', but maybe the Internet ate it. Anyway...) Just to add to what MHL said, I notice your error concerns fileparam.py which is odd. It should be present: /path/to/volatility$ find -type f -name fileparam.py ./volatility/plugins/fileparam.py In case MHL's suggestion doesn't fix it, can you find the fileparam.py file? Where did you get your copy of 2.4 from? Might be worth grabbing it again from github. Bridgey

10 years, 9 months

1
0
0 0

zeusscan

by dnardoni

Is zeusscan depreciated in version 2.4? Volatility Foundation Volatility Framework 2.4 ERROR : volatility.plugins.fileparam: The requested file doesn't exist

10 years, 9 months

4
3
0 0

Facebook Doubles Volatility Contest Prizes

by AAron Walters

As mentioned earlier this week, we have extended the deadline for the 2014 Volatility Plugin Contest until October 1st because an organization wanted to augment the prizes. We are excited to share that due to an extremely generous donation from Facebook, the total cash prizes have been doubled from $2250 USD to $4500 USD! If you have already submitted to the contest, you can use this extra time to fine tune your submission or submit another entry to improve your chances. If you were considering submitting, you now have an extra month to demonstrate your creativity, become a memory analysis pioneer, win the admiration of your peers, and give back to the community! It’s great to see some of the largest companies in the world showing their support for and giving back to the memory forensics community! Thank you, Facebook, and good luck to all participants in the contest - the stakes have literally just doubled! AAron Walters The Volatility Foundation

10 years, 9 months

1
0
0 0

2014 Volatility Plugin Contest Deadline Extended

by AAron Walters

Despite the fact we have already surpassed the number of submissions to last year’s contest, we are excited to announce that we have extended the deadline for the 2014 Volatility Plugin Contest until October 1st, 2014. We received a number of inquiries from people who recently learned about the competition when they purchased “The Art of Memory Forensics” and an exciting new competition sponsor (more details next week) that wanted to further augment our prizes. If you have already submitted to the contest, you can use this extra time to fine-tune your submission. If you were considering submitting, you now have an extra month to demonstrate your creativity and implement an innovative, interesting, and useful Volatility extension! It’s great to see some of the largest companies in the world showing their support for and giving back to the memory forensics community! AW The Volatility Foundation

10 years, 9 months

1
0
0 0

New Volatility Video: Automatic Detection and Extraction of Rootkits

by Andrew Case

This is the 2nd of 3 videos that we showed at Black Hat Arsenal this year: http://volatility-labs.blogspot.com.au/2014/08/volatility-24-at-blackhat-ar… This video takes you through using Volatility to automatically find, extract, and analyze a rootkit with both kernel and userland components. -- Thanks, Andrew (@attrc)

10 years, 9 months

1
0
0 0

New Volatility video: Tracking Mac OS X User Activity

by Andrew Case

We (the Volatility team) recently released Volatility 2.4 at Black Hat Arsenal in Vegas. To drive the demonstrations, MHL made 3 videos showing off interesting features of the framework. The first of these, Tracking Mac OS X User Activity, is now publicly available: http://volatility-labs.blogspot.com/2014/08/volatility-24-at-blackhat-arsen… We will be releasing the rest over the next several weeks. Please send us any feedback you may have on the videos, and we hope you enjoy the new features of 2.4! -- Thanks, Andrew (@attrc)

10 years, 10 months

1
0
0 0

Decompressing Windows 8 hiberfil.sys files

by J U

The "imagecopy" plugin in Volatility 2.4 does not decompress hiberfil.sys files from Windows 8 machines, at least in the tests that I have tried. In most cases, I'm getting identical files out, which means that the hiberfil.sys wasn't translated into a native physical address space, which suggests it's not supported? I have also tried using the Moonsols Windows Memory Toolkit which claims to support Windows 8, but that software seems to fail as well. Has anybody had any luck with uncompressing a Windows 8 hiberfil.sys file? Is there any other tool I can use to accomplish this? TIA

10 years, 10 months

2
1
0 0

Official Volatility 2.4 Cheat Sheet released!

by Andrew Case

The 2.4 edition of our popular Volatility cheat sheet is released! It features an updated Windows page, all new Linux and Mac OS X pages, and an extremely handy RTFM-style insert for Windows memory forensics. http://volatility-labs.blogspot.com/2014/08/new-volatility-24-cheet-sheet-w… Please let us know if you have any questions with the new plugins, and we hope that you are putting 2.4 to good use ;) -- Thanks, Andrew (@attrc)

10 years, 10 months

1
0
0 0

Open Memory Forensics Workshop 2014

by AAron Walters

vol-users, Registration has officially opened for the 6th Annual Open Memory Forensics Workshop (OMFW) 2014. This half-day workshop will be held prior to the 2014 Open Source Digital Forensics Conference (OSDFC) in Herndon, VA, USA, on November 4, 2014. "OMFW is the only digital forensics workshop focused on providing a venue for the most advanced digital investigators. It is intended for those people who realize that the only real defense against a creative technical human adversary is a creative technical human analyst. No shady vendors trying to describe how they re-implemented open source tools or boisterous trainers attempting to discuss topics they only superficially understand. This is your opportunity to learn directly from an international cadre of pioneering researchers and practitioners who have been shaping the field of memory analysis since its inception. Through a series of invited talks you will have the opportunity to engage this exciting community." We are still accepting presentations from people who are performing innovative memory analysis research or from people who have interesting case studies where memory forensics provided a critical component of the investigation. If you are interested in participating, please contact us. Submissions are due no later than October 1, 2014. This year's workshop will also present the results of The 2nd Annual Volatility Framework Plugin Contest! If you are interested in presenting at the conference, submitting a contest entry is another option. Selected contestants may be asked to present their work at the workshop and have it featured on the Volatility Labs Blog. All contest submissions are due by September 1, 2014. To learn more about the workshop, read testimonials of previous attendees, and find out what makes OMFW so unique, please visit the workshop website: http://www.volatilityfoundation.org/#!2014/cwat Details about the location will be provided upon registration. Pre-registration is required and space is LIMITED, so register early. Please note that it will NOT be possible to register at the door. Registration closes on October 24, 2014. Reserve your seat by contacting: info [at] volatilityfoundation [dot] org. Thanks, AAron Walters The Volatility Foundation

10 years, 10 months

1
0
0 0

New Paper: In Lieu of Swap: Analyzing Compressed RAM in Mac OS X and Linux

by Andrew Case

The research paper that Dr. Golden Richard and I won "Best Paper" with at DFRWS 2014 is now available along with our slides: http://volatility-labs.blogspot.com/2014/08/new-paper-in-lieu-of-swap-analy… If you have any questions about the research then please let me know. -- Thanks, Andrew (@attrc)

10 years, 10 months

1
0
0 0

Volatility 2.4 released!

by Andrew Case

The Volatility Team is happy to announce that Volatility 2.4 is now publicly released. Volatility 2.4 adds support for Windows 8, 8.1, 2012, and 2012 R2 memory dumps, Mac OS X Mavericks (up to 10.9.4), and Linux kernels up to 3.16. It also contains a large number of new plugins and features. Full information can be found here: http://volatility-labs.blogspot.com/2014/08/presenting-volatility-foundatio… Please let me know if you have any issues or questions with the release. -- Thanks, Andrew (@attrc)

10 years, 10 months

2
3
0 0

can volatility analysis xl dump-core

by Tawfiq Shah

Hi all I am wanting to perform memory introspection in my xen setup. I have been using libvmi with volatility to analysis memory dumps of a domU. I have done and tested it in Dom0 and it works. I now want to create a similar setup in a pv domU but i am unable to get libVMI working,. Since i can use xl dump-core <domid> <filename> in my pv to extract any hvm dump. I am using xsm and i have added all the necessary rules for memory extraction. This is the command i use to analysis the dump extracted using xl dump-core note: i created the Linuxkbeastx86 profile to the kernel i have infecting kbeast and this profile worked in dom0 when i used libVMI dump memory but in the pv it does not, also tested xl dump with volatility in dom0 and it did not work. So can volatility process xl dump ? below is the example out put i get python /root/Volatility/vol.py -f /root/kbeastDump --profile=Linuxkbeastx86 linux_check_modules Volatility Foundation Volatility Framework 2.3.1 Module Name ----------- No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareSnapshotFile: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space PyVmiAddressSpace: Location doesn't start with vmi:// MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF error: did not find any PT_NOTE segment with VBCORE VMWareSnapshotFile: Invalid VMware signature: 0x464c457f WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Incompatible profile Linuxkbeastx86 selected IA32PagedMemoryPae: Failed valid Address Space check IA32PagedMemory: Failed valid Address Space check PyVmiAddressSpace: Must be first Address Space FileAddressSpace: Must be first Address Space ArmAddressSpace: Failed valid Address Space check if anyone could give me some advice on this Thank you

10 years, 10 months

3
3
0 0

Malware Memory Forensics Workshop in conjunction with ACSAC

by Andrew Case

I am writing to help spread the word of the first annual Malware Memory Forensics (MMF) workshop that will be held along side ACSAC later this year in New Orleans: http://www.acsac.org/2014/workshops/issues/ I am on the review committee and the conference is being organized by academics with deep experience related to malware and memory forensics (e.g. General Co-Chair Golden Richard was who we chose as tech editor for The Art of Memory Forensics). If you are working with Volatility and performing your research inside the framework then this is the perfect venue for a formal/academic publication of your research . If you are a student, it would be an ideal fit for Masters or PHD projects, and if you are in industry then this conference works well as a bridge between industry and academia. Any questions can be sent to myself or to Golden (CC'ed). -- Thanks, Andrew (@attrc)

10 years, 10 months

1
0
0 0

problem with mftparser

by dnardoni

Anyone have any idea what is causing this error with mftparser? I have tried this in volatility versions 2.3 and 2.4. Might be a config issue with my system but not sure what it might be, so I thought I would ask the group. Volatility Foundation Volatility Framework 2.4 Scanning for MFT entries and building directory, this can take a while Traceback (most recent call last): File "vol.py", line 192, in <module> main() File "vol.py", line 183, in main command.execute() File "/Users/dnardoni/volatility/volatility_24/volatility/commands.py", line 127, in execute func(outfd, data) File "/Users/dnardoni/volatility/volatility_24/volatility/plugins/mftparser.py", line 728, in render_body for offset, mft_entry, attributes in data: File "/Users/dnardoni/volatility/volatility_24/volatility/plugins/mftparser.py", line 706, in calculate mft_entry.add_path(temp.FileName) File "/Users/dnardoni/volatility/volatility_24/volatility/obj.py", line 747, in __getattr__ return self.m(attr) File "/Users/dnardoni/volatility/volatility_24/volatility/obj.py", line 721, in m return element(self) File "/Users/dnardoni/volatility/volatility_24/volatility/plugins/mftparser.py", line 497, in <lambda> 'FileName': lambda x : obj.Object("FILE_NAME", offset = x.obj_offset + x.ContentOffset, vm = x.obj_vm), File "/Users/dnardoni/volatility/volatility_24/volatility/obj.py", line 377, in method proxied = self.proxied(name) File "/Users/dnardoni/volatility/volatility_24/volatility/obj.py", line 433, in proxied return self.v() File "/Users/dnardoni/volatility/volatility_24/volatility/obj.py", line 443, in v (val,) = struct.unpack(self.format_string, data) struct.error: unpack requires a string argument of length 2 Dave

10 years, 10 months

2
1
0 0

Samsung GT-I9023 Google Nexus S memory acquisition and analysis

by masdif

Hi all, I pre-ordered “The Art of Memory Forensics” at March 22nd :-) and as of today delivery is estimated for September 1st :-(. I really hope there is a chapter about debugging the memory acquisition process. ;-) Meanwhile may I kindly ask for your advice/hints how to debug the following? I am not able to successfully acquire and analyze a Nexus S Android memory dump. Where could I start to look for errors? How can I assure that the dump is valid? How can I assure that the profile is valid? Any hint is highly appreciated! :-) Thank you, Philipp ************************************************************ 0 Where I failed :-( Google at [1] offers three “Factory Images ‘soju’ for Nexus S (worldwide version, i9020t and i9023)”: 2.3.6 (GRK39F) 4.0.4 (IMM76D) 4.1.2 (JZO54K) Up to now I tried the first two. Just in case the two memory dumps as well as the two Volatility profiles are available here: https://mega.co.nz/#F!CEczgBqR!ksYLENHXoMCU8qzSBn79WA ************************************************************ 1 Nexus S with Android 2.3.6 Gingerbread ________________________________________ 1.1 Prepare the phone 1.1.0 Boot loader is unlocked: $ adb reboot bootloader $ fastboot oem unlock 1.1.1 Get the factory image from [2] and flash it $ tar –zxvf soju-grk39f-factory-5ab09c98.tgz $ cd soju-grk39f $ adb reboot bootloader $ ./flash-all.sh 1.1.2 Start phone Click through the initial settings Enable USB debugging Get version info: $ adb shell $ cat /proc/version Linux version 2.6.35.7-gf5f63ef (android-build(a)apa28.mtv.corp.google.com) (gcc version 4.4.3 (GCC) ) #1 PREEMPT Tue Aug 2 13:57:05 PDT 2011 1.1.3 Root the phone Get custom recovery from [5] (…because otherwise ADB sideload SuperSU won’t work) and flash custom recovery $ adb reboot bootloader $ fastboot flash recovery openrecovery-twrp-2.7.1.0-crespo.img Get SuperSU from [6] Sideload SuperSU $ adb reboot bootloader Go to “Recovery” -> “Advanced” -> “ADB Sideload” -> “Swipe to start sideload” $ adb sideload UPDATE-SuperSU-v2.01.zip Reboot the phone ________________________________________ 1.2 Prepare LiME 1.2.1 Get the Samsung kernel source from AOSP [7] $ mkdir -p ~/android/kernel && cd $_ $ git clone https://android.googlesource.com/kernel/samsung.git $ cd samsung $ git checkout f5f63ef 1.2.2 Setting Up a Build Environment with AOSP from [8] $ mkdir -p ~/android/aosp && cd $_ $ repo init -u https://android.googlesource.com/platform/manifest -b android-2.3.6_r0.9 $ repo sync $ . build/envsetup.sh $ lunch full_crespo-user Check compiler: $ arm-eabi-gcc --version arm-eabi-gcc (GCC) 4.4.3 Set environment variables: $ cd ~/android/kernel/samsung $ export ARCH=arm $ export SUBARCH=arm $ export CROSS_COMPILE=arm-eabi- 1.2.3 Compile the Samsung kernel Configure the kernel: $ make herring_defconfig Build the Samsung kernel: $ make 1.2.4 Download LiME from [9] and Cross Compile $ mkdir -p ~/android && cd $_ $ svn checkout http://lime-forensics.googlecode.com/svn/trunk/ lime $ cd ~/android/lime/src Edit Makefile (I take CCPATH from printenv | grep arm-eabi ) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ obj-m := lime.o lime-objs := tcp.o disk.o main.o KDIR := ~/android/kernel/samsung CCPATH := ~/android/aosp/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin PWD := $(shell pwd) default: $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/arm-eabi- -C $(KDIR) M=$(PWD) modules $(CCPATH)/arm-eabi-strip --strip-unneeded lime.ko $(MAKE) tidy tidy: rm -f *.o *.mod.c Module.symvers Module.markers modules.order \.*.o.cmd \.*.ko.cmd \.*.o.d rm -rf \.tmp_versions clean: $(MAKE) tidy rm -f *.ko ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Build LiME module: $ make ________________________________________ 1.3 Dump volatile memory $ adb push ~/android/lime/src/lime.ko /sdcard/lime.ko Screen must be unlocked now in order to grant ADB shell root access $ adb shell $ su # insmod /sdcard/lime.ko "path=/sdcard/lime.dump format=lime" # exit $ exit $ adb pull /sdcard/lime.dump ~/android/dump/NexusS_2.3.6.dump ________________________________________ 1.4 Build a Volatility Profile Get Volatility from [10]: $ svn checkout https://volatility.googlecode.com/svn/trunk/ ~/android/volatility $ cd ~/android/volatility/tools/linux Edit Makefile: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ obj-m += module.o KDIR := ~/android/kernel/samsung CCPATH := ~/android/aosp/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin -include version.mk all: dwarf dwarf: module.c $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/arm-eabi- -C $(KDIR) CONFIG_DEBUG_INFO=y M=$(PWD) modules dwarfdump -di module.ko > module.dwarf ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Build module: $ make Zip profile: $ zip ~/android/volatility/volatility/plugins/overlays/linux/_NexusS_2.3.6_GRK39F_.zip module.dwarf ~/android/kernel/samsung/System.map ________________________________________ 1.5 Examine the Memory Dump with Volatility $ cd ~/android/volatility/ $ $ python vol.py --info | grep Linux Volatility Foundation Volatility Framework 2.3.1 Linux_NexusS_2_3_6_GRK39F_ARM - A Profile for Linux _NexusS_2.3.6_GRK39F_ ARM linux_banner - Prints the Linux banner information linux_yarascan - A shell in the Linux memory image $ $ python vol.py --profile=Linux_NexusS_2_3_6_GRK39F_ARM -f ~/android/dump/NexusS_2.3.6.dump linux_pslist Volatility Foundation Volatility Framework 2.3.1 Offset Name Pid Uid Gid DTB Start Time ---------- -------------------- --------------- --------------- ------ ---------- ---------- No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareSnapshotFile: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space MachOAddressSpace: MachO Header signature invalid MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF64 Header signature invalid VMWareSnapshotFile: Invalid VMware signature: 0x1 WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Incompatible profile Linux_NexusS_2_3_6_GRK39F_ARM selected IA32PagedMemoryPae: Failed valid Address Space check IA32PagedMemory: Failed valid Address Space check FileAddressSpace: Must be first Address Space ArmAddressSpace: Failed valid Address Space check ________________________________________ 1.6 First attempt to debug $ xxd -l 32 ~/android/dump/NexusS_2.3.6.dump 0000000: 454d 694c 0100 0000 0000 0040 0000 0000 EMiL.......@.... 0000010: ffff ff4f 0000 0000 0000 0000 0000 0000 ...O............ => magic: 0x4c69 4d45 -> LiME version: 0x0000 0001 -> 1 s_addr: 0x0000 0000 4000 0000 e_addr: 0x0000 0000 4fff ffff reserved: 0x0000 0000 0000 0000 => Address range is: $ python -c 'print int(0x4fffffff) - int(0x40000000) + 1' 268435456 But file size is much bigger: $ stat -c %s ~/android/dump/NexusS_2.3.6.dump 401604672 268.435.456 Bytes + 32 Bytes Header != 401.604.672 Bytes file size!!! ************************************************************ 2 Nexus S with Android 4.0.4 Ice Cream Sandwich ________________________________________ 2.1 Prepare the phone 2.1.0 Boot loader is unlocked 2.1.1 Get the factory image from [3] and flash it $ tar –zxvf soju-imm76d-factory-ca4ae9ee.tgz $ cd soju-imm76d $ adb reboot bootloader $ ./flash-all.sh 2.1.2 Start phone - as described before – $ cat /proc/version Linux version 3.0.8-g6656123 (android-build(a)vpbs1.mtv.corp.google.com) (gcc version 4.4.3 (GCC) ) #1 PREEMPT Thu Feb 2 16:56:02 PST 2012 2.1.3 Root the phone - as described before - ________________________________________ 2.2 Prepare LiME 2.2.1 Get the Samsung kernel source from AOSP [7] $ mkdir -p ~/android/kernel && cd $_ $ git clone https://android.googlesource.com/kernel/samsung.git $ cd samsung $ git checkout 6656123 2.2.2 Setting Up a Build Environment with AOSP from [8] $ mkdir -p ~/android/aosp && cd $_ $ repo init -u https://android.googlesource.com/platform/manifest -b android-4.0.4_r1.1 $ repo sync $ . build/envsetup.sh $ lunch full_crespo-user Check compiler: $ arm-eabi-gcc --version arm-eabi-gcc (GCC) 4.4.3 Set environment variables: $ cd ~/android/kernel/samsung $ export ARCH=arm $ export SUBARCH=arm $ export CROSS_COMPILE=arm-eabi- 2.2.3 Compile the Samsung kernel - as described before - 2.2.4 Download LiME from [9] and Cross Compile - as described before - ________________________________________ 2.3 Dump volatile memory - as described before – $ adb pull /sdcard/lime.dump ~/android/dump/NexusS_4.0.4.dump ________________________________________ 2.4 Build a Volatility Profile Get and build Volatility - as described before - $ zip ~/android/volatility/volatility/plugins/overlays/linux/_NexusS_4.0.4_IMM76D_.zip module.dwarf ~/android/kernel/samsung/System.map ________________________________________ 2.5 Examine the Memory Dump with Volatility $ cd ~/android/volatility/ $ $ python vol.py --info | grep Linux Volatility Foundation Volatility Framework 2.3.1 linux_banner - Prints the Linux banner information linux_yarascan - A shell in the Linux memory image Linux_NexusS_2_3_6_GRK39F_ARM - A Profile for Linux _NexusS_2.3.6_GRK39F_ ARM Linux_NexusS_4_0_4_IMM76D_ARM - A Profile for Linux _NexusS_4.0.4_IMM76D_ ARM $ $ python vol.py --profile=Linux_NexusS_4_0_4_IMM76D_ARM -f ~/android/dump/NexusS_4.0.4.dump linux_pslist Volatility Foundation Volatility Framework 2.3.1 Offset Name Pid Uid Gid DTB Start Time ---------- -------------------- --------------- --------------- ------ ---------- ---------- No suitable address space mapping found Tried to open image as: - the rest as described before – ________________________________________ 2.6 First attempt to debug $ xxd -l 32 ~/android/dump/NexusS_2.3.6.dump 0000000: 454d 694c 0100 0000 0000 0040 0000 0000 EMiL.......@.... 0000010: ffff ff4f 0000 0000 0000 0000 0000 0000 ...O............ => magic: 0x4c69 4d45 -> LiME version: 0x0000 0001 -> 1 s_addr: 0x0000 0000 4000 0000 e_addr: 0x0000 0000 4fff ffff reserved: 0x0000 0000 0000 0000 => Address range is: $ python -c 'print int(0x4fffffff) - int(0x40000000) + 1' 268435456 But file size is still bigger: $ stat -c %s ~/android/dump/NexusS_4.0.4.dump 325775424 268.435.456 Bytes + 32 Bytes Header != 325.775.424 Bytes file size!!! ************************************************************ 3 Links [1] https://developers.google.com/android/nexus/images\#soju [2] https://dl.google.com/dl/android/aosp/soju-grk39f-factory-5ab09c98.tgz [3] https://dl.google.com/dl/android/aosp/soju-imm76d-factory-ca4ae9ee.tgz [4] https://dl.google.com/dl/android/aosp/soju-jzo54k-factory-36602333.tgz [5] http://techerrata.com/file/twrp2/crespo/openrecovery-twrp-2.7.1.0-crespo.img [6] http://download.chainfire.eu/supersu [7] https://android.googlesource.com/kernel/samsung.git [8] https://android.googlesource.com/platform/manifest [9] http://lime-forensics.googlecode.com/svn/trunk/ [10] https://volatility.googlecode.com/svn/trunk/

10 years, 10 months

4
7
0 0

Announcing trainings in Austin, San Francisco, and Brazil!

by Andrew Case

Amidst the release of The Art of Memory Forensics and our upcoming events at Black Hat, we also have scheduled several training courses for the end of this year and early next year: http://volatility-labs.blogspot.com/2014/07/announcing-windows-malware-and-… Based on demand for trainings before the book's release and the amazing pace of sales of the book (currently #1084 on Amazon), we imagine that these classes will fill quickly. Please contact us ASAP if you would like to attend. Also, we reserve a small number of deeply discounted seats in each class for full time college students studying in related fields. We offer this to give students performing research access to the most advanced topics in the field and also to help prepare the next wave of investigators. If you are a college professor with students who may be interested or a student yourself then please contact us. -- Thanks, Andrew (@attrc)

10 years, 10 months

1
0
0 0

Security Weekly podcast on the Art of Memory Forensics

by Andrew Case

Tonight, myself, MHL, and Jamie will be on the Security Weekly (formerly PaulDotCom) podcast discussing the new book: http://securityweekly.com/2014/07/join-us-for-episode-380-with-andrew-case-… If you cannot catch it live then they always post the recording within a few days of the show. Also, we are hearing that many people are getting their pre-order shipping notifications for next week, and that the Kindle version is already being sent to people's devices! If you are going to be at Black Hat be sure to stop by on Thursday during the book signing! -- Thanks, Andrew (@attrc)

10 years, 10 months

3
2
0 0

Volatility at Black Hat USA & DFRWS!

by Andrew Case

It has been a busy year for the Volatility team, and we are inviting you to celebrate the success with us at Black Hat and DFRWS. We have a number of events happening across these conferences and have listed them all in the following blog post: http://volatility-labs.blogspot.com/2014/07/volatility-at-black-hat-usa-dfr… We hope to see you all in Vegas and be sure to check out Dr. Golden's talk if you will be at DFRWS! -- Thanks, Andrew (@attrc)

10 years, 11 months

1
0
0 0

The table of contents & preview for the Art of Memory Forensics is now online!

by Andrew Case

We are very happy to announce that you can now see the table of contents and search through the Art of Memory Forensics on Amazon! http://amzn.to/1o3ACn7 This book, written by the core Volatility developers, is over 900 pages of memory forensics and malware analysis across Windows, Mac, and Linux. It will be officially released at Blackhat and around this time it will also be available through Amazon and other retailers. It will be available in both hard copy and digital formats. If you have any questions about the book please let us know, and we will have more information about the release at Blackhat as it gets closer. -- Thanks, Andrew (@attrc)

10 years, 11 months

1
0
0 0

OSDFC submission, Blackhat Arsenal, & LinkedIn Group!

by Andrew Case

We wanted to give everyone a quick update on some recent events in the Volatility community. First, the submissions for the Open Source Digital Forensics Conference are available for voting. This conference's talk selection works by posting each CFP submission in anonymized form and choosing talks based on voting feedback from the community. All of the talks can be found here: http://www.basistech.com/osdfcon/osdfcon-vote-for-presentations The submission from the Volatility Team is 'Next Generation Memory Forensics'. If it sounds interesting to you then please give it a +1! Second, our submission to Blackhat Arsenal was accepted! https://www.blackhat.com/us-14/arsenal.html#Ligh At this event we will be releasing the highly anticipated Volatility 2.4 that includes support for Windows 8, 8.1, 2012, 2012 R2 as well as new plugins for Truecrypt, Linux, and Mac. As Blackhat gets closer we will have more information on other events there including a book signing and release party. Finally, we now have a LinkedIn group for the Volatility and memory forensics community: https://www.linkedin.com/groups?mostRecent=&gid=8128809 This group is meant to allow analysts and researchers to ask questions, learn from each other, and network. The group is open to all but marked private to (hopefully) avoid spam. -- Thanks, Andrew (@attrc)

10 years, 11 months

1
0
0 0

Process hollowing

by Carlos Angeles

Hello all, I'm analyzing a malware sample that is doing process hollowing. While doing dynamic analysis, with Process Explorer open, I can see the legitimate EXE (that appears to get hollowed) get started by the malware, and is then orphaned as the malware terminates itself. A few seconds later I see network communication starting. The malfind plugin identifies the process as malware but when I try to dump process from memory, the strings on the dumped process look the same as the strings of the legitimate file in the System32 folder. Using the yarascan plugin (following the example on the wiki) I'm able to locate some strings (domain name, IP address, file requested by GET) that are associated with the PID of the suspected hollowed process. Oh, and the malware is packed so I assume the unpacked code is being placed into the address space of the legitimate file in memory. The capture is a .vmem from a VM snapshot. Any thoughts on how I can locate the unpacked code in memory? Shouldn't dumping the PID with procexedump contain the unpacked code? I've dumped the process by PID and physical offset (from psscan). Thanks, Carlos

11 years

2
6
0 0

LiME in real world Android forensics

by masdif

Hi all, Android Memory acquisition will be part of a paper I have to write. So far I have no problem to follow the description for an AVD on https://code.google.com/p/volatility/wiki/AndroidMemoryForensic Please excuse this noob question (and my bad English) but I'm going crazy figuring this out: Can LiME be used in real life Android forensics that is Android memory is acquired without having to reboot the Android device beforehand? Let's say: I get an running Android mobile phone and for some lucky reason it is both rooted and the user interface unlocked. (Are there any statistics available how often this is the case?) My task is to acquire its RAM. As far as I understood in order to use Lime for RAM acquisition I have to a) get the Android kernel's source code from the manufacturer, b) cross compile a new kernel with some settings for later being able to insmod the LiME kernel module, c) flash the compiled kernel onto the phone and d) reboot the phone to get the new kernel running, which e) destroys all the RAM I wanted to acquire, before I can f) insmod LiME. Please be patient and give me a hint where I'm going wrong?! All papers I found so far used prepared phones. Thanks a lot and have a nice weekend, Philipp

11 years

4
6
0 0

Many exciting updates in the world of Volatility!

by Andrew Case

There are many new developments in the world of Volatility that we are now happy to announce. - The 2014 Volatility Plugin Contest has started - We will be hosting a public training in Austin in December - We have partnered with GMG Systems to provide our students access to what we consider to be the most accurate and reliable memory acquisition tool available - The Volatility Foundation website is now live For complete information on these and more, please see the following blog post: http://volatility-labs.blogspot.com/2014/05/volatility-update-all-things.ht… -- Thanks, Andrew (@attrc)

11 years

1
0
0 0

CentOS 5.8 profile not working

by Toan. Pham Van

Dear sir, Currently we doing investigate an security breach, our server is CentOS 5.8. After dump memory raw, we can not processing with Volatility. We have read the topic : http://lists.volatilityfoundation.org/pipermail/vol-users/2013-February/000… After edit to that DTB we found it work on LIME profile but doesn't work on Raw memory dump. Can we have some instruction how to convert Raw memory to LIME? Or how to debug to find correct DTB in raw memory only? Btw, we trying to brute force like your advise but it very long since the range is from -0x200000 -> 0x200000. Regards,

11 years

1
0
0 0

Is there a public github branch for the osx 9.2 compatibility layer?

by Shannon Freude

I'm looking for a patch-set that gets OSX 9.2 dumps from OSXPmem at least marginally working. I know it's supposed to be in the upcoming vol-2.4 release, but I'ld really like to see the progress/use volatility instead of having to beat volafox in to shape to get 9.2 dumps to work.

11 years

2
1
0 0

VAD nodes: Private memory, but Prototype PTEs?!

by Bridgey

Hi all, I'm trying to understand what I've misunderstood. Consider this entry from a run of vadinfo: VAD node @ 0x84f1f3b0 Start 0x7ffde000 End 0x7ffdefff Tag Vadl Flags: CommitCharge: 1, MemCommit: 1, NoChange: 1, PrivateMemory: 1, Protection: 4 Protection: PAGE_READWRITE Vad Type: VadNone First prototype PTE: 94181720 Last contiguous PTE: 94181728 This node represents a range which is private (PrivateMemory: 1). If it's private, i.e. not shareable, why are there Prototype PTEs? I though prototype PTEs were only used when a range was shareable? I have a few Vadl nodes like this. The VadS nodes in the output with 'PrivateMemory: 1' don't show any prototype PTEs. Any pointers greatly appreciated.

11 years, 1 month

1
0
0 0

USN Parser for volatility

by Spencer, Tom

Hello all, Just wanted to let people know I have released a USN Journal record parser plugin for volatility. https://github.com/tomspencer/volatility/tree/master/usnparser For anyone who wants a refresher on the USN journal and its forensic significance, I recommend these <http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html> sites <http://securitybraindump.blogspot.com/2011/07/dear-diary-today-i-was-infect…> . The USN journal has been very useful to us in a variety of circumstances, so I highly recommend including it in your work/timelining flow if you dont already. Ive even seen situations where journal records from external NTFS volumes persist in memory even after the device is removed, but those results have been inconsistent. This plugin should work on any version of Windows that does USN journaling (Vista/2008 and up, XP SP3 if you specifically turn it on), and it should play well with Unicode file names including calling out special Unicode characters like directional changes. For an example of calling out direction changes: 2014-04-16 20:51:23.116,0x257L,0x3L,0x14de3L,0x3L,0x4806360L,"utf-canary.<RLO>txt.scr",RENAME_NEW_NAME & CLOSE,ARCHIVE The <RLO> indicates a Unicode Right-To-Left Override character. This means that although the actual filename extension was txt.scr, a screen saver filetype which is expected to be an executable, it would have appeared to the user as utf-canary.rcs.txt which most users would expect to be a text file they could safely click. This is my first volatility plugin so Id love any feedback/suggestions/questions. Based on some feedback from MHL I'll be doing some testing to see if I should turn on timestamp validation by default, but I'm open to other changes/additions people would like to see. Basic notes on the plugin are below. Enjoy! Thanks, Tom A note on USN record versions. The literature I can find seems to suggest that starting with Windows NT 6.2 families (8/2012) the OS should be using version 3 records, and this plugin does support these records. That said, testing has shown that at least in memory, these OSs still seem to use v2 records. As such, unless otherwise specified with the -R3 flag, this plugin will always assume v2 records. In my testing there has been a significant number of duplicates in memory, so piping to sort u can be effective. Invocation example: CSV output $ vol.py --profile Win7SP1x64 -f Windows7SP1x64.vmem usnparser --output=csv Volatility Foundation Volatility Framework 2.3.1 timestamp,MFTEntry,MFTEntryUSN,Parent,ParentUSN,usn#,"Filename",Reason,Attributes 2014-01-26 09:01:19.079,0x5056L,0x1L,0x7beL,0x1L,0x10f35c0L,"ngen_service.log",EXTEND & CLOSE,ARCHIVE 2014-01-26 09:01:19.079,0x7d8L,0x86L,0x7beL,0x1L,0x10f3620L,"ngen_service.lock",CREATE & DELETE & CLOSE,ARCHIVE 2014-01-26 09:01:19.142,0x7d8L,0x89L,0x28eL,0x1L,0x10f39d8L,"GACLock.dat",CREATE,ARCHIVE & TEMPORARY 2014-01-26 09:01:19.142,0x7d8L,0x89L,0x28eL,0x1L,0x10f3a30L,"GACLock.dat",CREATE & DELETE & CLOSE,ARCHIVE & TEMPORARY .... BODY output, suitable for using with mactime $ vol.py --profile Win7SP1x64 -f Windows7SP1x64.vmem usnparser --output=body | head Volatility Foundation Volatility Framework 2.3.1 0|[USN JOURNAL] ngen_service.log EXTEND & CLOSE/USN: 17774016/PARENT MFT: 1982|20566|---a-----------|0|0|0|1390726879|1390726879|1390726879|1390726879 0|[USN JOURNAL] ngen_service.lock CREATE & DELETE & CLOSE/USN: 17774112/PARENT MFT: 1982|2008|---a-----------|0|0|0|1390726879|1390726879|1390726879|1390726879 0|[USN JOURNAL] GACLock.dat CREATE/USN: 17775064/PARENT MFT: 654|2008|---a--t--------|0|0|0|1390726879|1390726879|1390726879|1390726879 0|[USN JOURNAL] GACLock.dat CREATE & DELETE & CLOSE/USN: 17775152/PARENT MFT: 654|2008|---a--t--------|0|0|0|1390726879|1390726879|1390726879|1390726879 The current version's help output (flags specific to usnparser start at "-T, --timestamp"): $ vol.py usnparser -h Volatility Foundation Volatility Framework 2.3.1 Usage: Volatility - A memory forensics analysis platform. Options: -h, --help list all available options and their default values. Default values may be set in the configuration file (/etc/volatilityrc) --conf-file=/home/vol/.volatilityrc User based configuration file -d, --debug Debug volatility --plugins=PLUGINS Additional plugin directories to use (colon separated) --info Print information about all registered objects --cache-directory=/home/vol/.cache/volatility Directory where cache files are stored --cache Use caching --tz=TZ Sets the timezone for displaying timestamps -f FILENAME, --filename=FILENAME Filename to use when opening an image --profile=WinXPSP2x86 Name of the profile to load -l LOCATION, --location=LOCATION A URN location from which to load an address space -w, --write Enable write support --dtb=DTB DTB Address --output=text Output in this format (format support is module specific) --output-file=OUTPUT_FILE write output in this file -v, --verbose Verbose information --shift=SHIFT Mac KASLR shift address -g KDBG, --kdbg=KDBG Specify a specific KDBG virtual address -k KPCR, --kpcr=KPCR Specify a specific KPCR address -T, --timestamp Print timestamps instead of human-readable dates -E, --unixtime Use Unix Epoch 32-bit timestamps instead of native Windows 64-bit timestamps (loses subsecond accuracy). DOES NOT imply -T above. -C, --checktime Don't show entries with timestamps outside of unix epoch range to reduce corrupt entries -S, --strict Enable stricter checks on record integrity to further reduce corrupt entries -O, --offset Show the physical offset for each record -R RECORDTYPE, --recordtype=RECORDTYPE Force version of USN record (2 or 3) to search for. In testing so far all OS's seem to use version 2 records in memory (even 8.1/2012r2 which purport to use R3). As such, default is R2. -U, --unicode Show unicode (utf-8) filenames. Be aware that due to corrupted records there will likely be strange characters in some places. Using -C and -S can help cut this down. --------------------------------- Module USNParser --------------------------------- Scans for and parses USN journal records

11 years, 1 month

1
0
0 0

Volatility issue #383: Linux 'tmpfs' extraction on multiple CPU sytems

by Torres, Geoff (Global Cyber Security)

Hi, According to Volatility issue #383 'tmpfs' extraction doesn't work because Volatility doesn't support NUMA systems. Question 1 - Is it on the roadmap for future versions? I deal primarily with Multi-CPU cloud systems so this is definitely a desired feature. Question 2- Is it reasonably feasible to manually extract tmpfs from a system RAM dump? Following the 'linux_tmpfs' module through the debugger showed that it was able to locate the /dev/shm tmpfs file system (replicating 2 levels in my output directory), it just croaked when it came time to retrieve the actual file data. I figure that if I can manually determine whatever offset it needs then I can set the proper variable in a debug session. Any thoughts? Thanks, Geoff ============================== Geoff Torres HP Global Cyber Security 8000 Foothills Blvd. Roseville, CA. 95747 916-785-3323 ==============================

11 years, 1 month

1
0
0 0

TrueCrypt File Found in Handles extraction, but can't replicate results

by Robert Merriott

Hello I've been testing volatility and looking through the results. In particular, within the Handles extraction, I found the following line... 0xfffffa8009648800 3544 0x1a78 0x120089 File \Device\TrueCryptVolumeK\Test.txt This is a file that I had stored in a hidden volume. I attempted to re-create this type of entry with 3 further memory dumps with no such success (No files within TrueCrypt volume). Can anyone advise why this filename "Test.txt" was found? I see that a lot of files can be found in the Handles extraction, but haven't been able to find any documentation on how files are included in this section. I ran the following command on an 8GB Memory dump which was captured via FTK Imager... vol.exe -f memdump.mem --profile=Win7SP1x64 --output=text --output-file=handles-files.txt handles -t File This result was a total surprise to find. In further testing, I attempted to do the following within the hidden volume... - Create new files - Copy files into the volume - Leave files open while closing the volume within TrueCrypt Thanks, R

11 years, 1 month

2
2
0 0

Unexpected results

by Lay, James

Hey all, So...Win 7 SP1 64 bit..here's what I got: vol.py -f bleh-20140421-203458.raw imageinfo Volatility Foundation Volatility Framework 2.3.1 Determining profile based on KDBG search... Suggested Profile(s) : Win2008R2SP0x64, Win7SP1x64, Win7SP0x64, Win2008R2SP1x64 AS Layer1 : AMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/home/bleh/bleh-20140421-203458.raw) PAE type : No PAE DTB : 0x187000L vol.py --profile Win7SP1x64 -f bleh-20140421-203458.raw pslist Volatility Foundation Volatility Framework 2.3.1 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0xfffffa80066b8040 5??b 32...4 79...2 14...6 -------- ------ 1 3302-11-11 21:17:40 UTC+0000 And that's it. This was dumped using DumpIt. Is there something I'm missing? My process: wget latest volatility python setup.py build sudo python setup.py install then the above commands. Thanks for any assistance. James

11 years, 1 month

2
3
0 0

Issues reading Android memory dump using Volatility 2.3.1

by Tora, Hamidullah

I’ve followed the LiME documentation to cross compile the kernel and create a loadable kernel module to dump the volatile memory off a Google Glass XE12 running Linux version 3.0.31-23935-g01ccedd (android-build(a)vpba28.mtv.corp.google.com) (gcc version 4.4.3 (GCC)). Initial attempts to install the loadable kernel module for LiME would error with: dmesg output: … lime: disagrees about version of symbol sock_create_kern lime: Unkonwn symbol sock_create_kern (err –22) lime: disagrees about version of symbol sock_setsockopt lime: Unknown symbol sock_setsockopt (err –22) lime: disagrees about version of symbol sock_sendmsg lime: Unkonwn symbol sock_sendmsg (err –22) … Likely due to the version of symbols in the functions implemented in tcp.h in the LiME package. After modifying LiME source code (main.c) to ignore all tcp construct and to write directly to the /sdcard, we were able to get a ~1 GB (raw, padded, and lime formatted) memory dumps. Here is the command we issued to get the memory dump: insmod limed.ko "path=/sdcard/mem.lime format=lime” insmod limed.ko "path=/sdcard/mem.raw format=raw" insmod limed.ko "path=/sdcard/mem.padded format=padded" Next we followed the documentation on Volatility AndroidMemoryForensics Wiki to create a profile using the Google Glass source code (omap) and dwarfdump. Here is the Makefile we used: obj-m += module.o KDIR := /home/htora/Development/omap CCPATH := /home/htora/Development/adt-bundle-linux-x86_64-20140321/ndk/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin DWARFDUMP := /usr/bin/dwarfdump -include version.mk all: dwarf dwarf: module.c $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/arm-linux-androideabi- -C $(KDIR) CONFIG_DEBUG_INFO=y M=$(PWD) modules $(DWARFDUMP) -di module.ko > module.dwarf Here are the results from running the make file: make ARCH=arm CROSS_COMPILE=/home/htora/Development/adt-bundle-linux-x86_64-20140321/ndk/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin/arm-linux-androideabi- -C /home/htora/Development/omap CONFIG_DEBUG_INFO=y M=/home/htora/install/volatility-2.3.1/tools/linux modules make[1]: Entering directory `/home/htora/Development/omap' CC [M] /home/htora/install/volatility-2.3.1/tools/linux/module.o Building modules, stage 2. MODPOST 1 modules CC /home/htora/install/volatility-2.3.1/tools/linux/module.mod.o LD [M] /home/htora/install/volatility-2.3.1/tools/linux/module.ko make[1]: Leaving directory `/home/htora/Development/omap' /usr/bin/dwarfdump -di module.ko > module.dwarf As documented, we copied over the created module.dwarf file and the System.map file to the Volatility plugins directory and confirmed the profile exists. root@ubuntu:/home/vol/Desktop/volatility/volatility_2.3.1.3543# ./vol.py --info | grep Linux Volatility Foundation Volatility Framework 2.3.1.3543(T) LinuxomapARM - A Profile for Linux omap ARM linux_banner - Prints the Linux banner information linux_yarascan - A shell in the Linux memory image However, using Volatility 2.3.1.3543 we are unable to parse the memory dump, here are the results from running volatility against the memory dump: root@ubuntu:/home/vol/Desktop/volatility/volatility_2.3.1.3543# ./vol.py --profile=LinuxomapARM -f /home/vol/Development/mem.lime linux_pslist Volatility Foundation Volatility Framework 2.3.1.3543(T) WARNING : volatility.obj : Overlay structure _POOL_TRACKER_BIG_PAGES not present in vtypes WARNING : volatility.obj : Overlay structure _POOL_TRACKER_TABLE not present in vtypes WARNING : volatility.obj : Overlay structure _POOL_TRACKER_BIG_PAGES not present in vtypes WARNING : volatility.obj : Overlay structure _POOL_TRACKER_TABLE not present in vtypes Offset Name Pid Uid Gid DTB Start Time ---------- -------------------- --------------- --------------- ------ ---------- ————— Here is the debug output: root@ubuntu:/home/vol/Desktop/volatility/volatility_2.3.1.3543# ./vol.py -d --profile=LinuxomapARM -f /home/vol/Development/mem.lime linux_pstree Volatility Foundation Volatility Framework 2.3.1.3543(T) DEBUG : volatility.plugins.overlays.linux.linux: omap: Found dwarf file tmp/System.map with 458 symbols DEBUG : volatility.plugins.overlays.linux.linux: omap: Found system file tmp/System.map with 1 symbols DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from PoolTrackTagOverlay WARNING : volatility.obj : Overlay structure _POOL_TRACKER_BIG_PAGES not present in vtypes WARNING : volatility.obj : Overlay structure _POOL_TRACKER_TABLE not present in vtypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay Name Pid Uid DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.plugins.overlays.linux.linux: omap: Found dwarf file tmp/System.map with 458 symbols DEBUG : volatility.plugins.overlays.linux.linux: omap: Found system file tmp/System.map with 1 symbols DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from PoolTrackTagOverlay WARNING : volatility.obj : Overlay structure _POOL_TRACKER_BIG_PAGES not present in vtypes WARNING : volatility.obj : Overlay structure _POOL_TRACKER_TABLE not present in vtypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0xacf38ac> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.lime.LimeAddressSpace object at 0xacf38ec> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.arm.ArmAddressSpace object at 0xc4fb96c> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> Appreciate any guidance and help in this matter. Thanks -- Hamidullah Tora Neustar, Inc. / Sr. Security Engineer – NeuCIRT 46000 Center Oak Plaza Sterling, VA 20166 Office: +1.571.434.3410 Mobile: +1.571.527.7859 Pager: +1.571.247.1684 Fax: +1.571.434.5606 / hamidullah.tora(a)neustar.biz<mailto:hamidullah.tora@neustar.biz> / www.neustar.biz<http://www.neustar.biz/>

11 years, 1 month

1
0
0 0

Extracting document files from hiberfil.sys

by Andy Bellman

Hello again, So, now that I am using the right profile, the plug ins seem to work. My goal is recovering unsaved notepad files from hibernation. I have a hiberfil.sys from a Win 7 SP1 64 bit system. My next step seemed to be using pslist to get the PIDs, and putting those into one of the built in plugins. I've tried dumpfiles, vaddump, memdump, and some others. It looks like I should be able to piece something together between the results of dumpfiles with a PID switch, and of vaddump with a PID switch. I haven't figured that out yet. I'm wondering if there is a more specific switch. They both seem to produce a lot more files than I need. Is there a better way to use volatility's built in tools to pull out files from notepad? Is there an add on that I can download which will pull out something more quickly and cleanly? Thanks, andybellman(a)outlook.com

11 years, 2 months

3
4
0 0

Trouble using certain commands on Win7SP1x64 memory dump

by Jon Q

Good afternoon, I'm having a bit of trouble using Volatility for memory forensics with the goal of malware detection. I've captured a memory dump of a Windows 7 SP1 x64 machine using winpmem_1.5.5.exe and am using the 2.3.1 standalone variant of Volatility on a Windows 7 SP1 x64 machine. When i issue commands such as 'connections' , 'connscan' , 'sockets' i get the error "This command does not support the profile Win7SP1x64." I've also tried Volatility Standalone 2.3 and 2.2. Any explanation would be greatly appreciated. Thanks!

11 years, 2 months

4
3
0 0

MFT Parser 64 Bit

by markus neis

Hi, is anybody else also running into issues when using mftparser on Win7 64 Bit? I get the following: WARNING : volatility.obj : Cant find object NullString in profile <volatility.plugins.overlays.windows.win7.Win7SP1x64 object at 0xb4fc44c>? Which results in entries like: (FN) 0x184000|None\None\None\None\None\None\None|153380|---a-----------|0|0|480|1336379877|1336379877|1336379877|1336379877 Thanks, Markus

11 years, 2 months

3
2
0 0

PSXView Problems.

by Michael Certini

I am having problems with my PSXView. On multiple occasions I have started this command and left it running overnight and by the next morning there has been no reported data. The command appears to be stalled. I am not sure where to look for the exact problem. I have looked into the Python address space with WinDbg and have noted, with !VAD, a segment of memory that is EXECUTE_READWRITE that is not listed as a process. It is identified as "Private". When peering into the segment of memory, I have noted a number of locations where there is an "MZ" prefix that designates a Windows PE. This is followed by "This program cannot......" so I know that this block contains executable code. When analyzing the code further there is a number of these programs, I have found headers designating that these are DLLs. Should this code block be present? With my limited training, I understand that all DLLs should be loaded by the loader and reflected in the address space with a VAD not burried in a segment of code. Has anyone else experienced this problem? Is my PSXView problem related to something else? Is there a way to isolate the issue further from here? I did a dump of Python using Procexedump but have not reviewed the IAT of the file or attempted to disassemble the file. I am new to reverse engineering so I am looking for the closest rope to grab onto.

11 years, 2 months

2
1
0 0

Unable to parse memory on ARMv6.1 with linux 2.6.31.14 + grsec+pax

by Roberto Martelloni

Hi all, I've followed the documentation to first dump the memory device cross compiling lime and then creating the profile for a linux device on arm. Unfortunately I wasn't able to use volatility on the memory dump. I'm using volatility 2.3.1, the kernel is a linux vanilla 2.6.31.14 + a custom grsecurity+pax configuration. Below some output from the commands, any suggestion on next step to troubleshoot where is the problem ? boos@vnoise:~/Downloads/volatility-2.3.1$ python vol.py --info | grep Profile | grep Linux Volatility Foundation Volatility Framework 2.3.1 LinuxTESTARM - A Profile for Linux TEST ARM $ python vol.py -f /home/boos/arm-mem-image imageinfo Determining profile based on KDBG search... Suggested Profile(s) : No suggestion (Instantiated with LinuxUbuntu1204x64) AS Layer1 : LimeAddressSpace (Unnamed AS) AS Layer2 : FileAddressSpace (/home/boos/arm-mem-image) PAE type : No PAE DTB : 0x1c0d000L Traceback (most recent call last): File "vol.py", line 184, in <module> main() File "vol.py", line 175, in main command.execute() File "/home/boos/Downloads/volatility-2.3.1/volatility/commands.py", line 122, in execute func(outfd, data) File "/home/boos/Downloads/volatility-2.3.1/volatility/plugins/imageinfo.py", line 36, in render_text for k, v in data: File "/home/boos/Downloads/volatility-2.3.1/volatility/plugins/imageinfo.py", line 93, in calculate kdbgoffset = volmagic.KDBG.v() File "/home/boos/Downloads/volatility-2.3.1/volatility/obj.py", line 737, in __getattr__ return self.m(attr) File "/home/boos/Downloads/volatility-2.3.1/volatility/obj.py", line 719, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct VOLATILITY_MAGIC has no member KDBG boos@vnoise:~/Downloads/volatility-2.3.1$ python vol.py --profile LinuxTESTARM -f /home/boos/arm-mem-image linux_dmesg Volatility Foundation Volatility Framework 2.3.1 No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareSnapshotFile: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space MachOAddressSpace: MachO Header signature invalid MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF64 Header signature invalid VMWareSnapshotFile: Invalid VMware signature: 0x0 WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Incompatible profile LinuxTESTARM selected IA32PagedMemoryPae: Failed valid Address Space check IA32PagedMemory: Failed valid Address Space check FileAddressSpace: Must be first Address Space ArmAddressSpace: Failed valid Address Space check -- Roberto Martelloni boos @ http://boos.core-dumped.info

11 years, 2 months

4
5
0 0

Retrieving files from Linux page cache

by Sebastian Biedermann

Hi guys, I would like to extract the files which are temporary cached by the Linux page cache from an Ubuntu memory image. When I read a file in Linux for the first time, it gets read from the hard drive but gets also cached. A second read of the same file then goes faster. Same for writing. /proc/sys/vm/dirty_expire_centiseconds defines how long data remains in the page cache until it is written to disk. First I thought I could use Linux_find_file command of volatility, however this command is only targeting the tmpfs, right? Is there another way of extracting files from the Linux page cache? Thank you! Sebastian

11 years, 2 months

2
1
0 0

Building a Decoder for the CVE-2014-0502 Shellcode

by Andrew Case

Hello All, I have published a new blog post analyzing the encrypted shellcode from the main CVE-2014-0502 attack: http://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0… It goes through some functionality of the malicious Flash file followed by analysis of the shellcode used within the encrypted GIF. This attack's particular use of a malicious Flash file along with an "encrypted" GIF shows some of the complexity of modern attacks, and highlights the diverse set of skills needed to analyze the attacks (Flash reversing, binary shellcode reversing, and understanding exploitation techniques, such as ROP, ALSR bypass, etc.). This particular attack was also noticeable because of how many different companies published public research on it (I have references in the blog). I hope that you enjoy the blog post and potentially learn something from it. I am happy that my anonymous friend allowed me to publish the research. -- Thanks, Andrew (@attrc)

11 years, 2 months

2
1
0 0

Re: [Vol-users] KDBG errors

by Michael Ligh

Ah, the good old “here’s a partial memory dump for you to analyze” Sadly, this happens quite often. Thanks for the update! Michael -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com Training: http://memoryanalysis.net On Apr 7, 2014, at 4:45 PM, Carlos Angeles <cangeles(a)gmail.com> wrote: > Andrew, Michael, > > The person that captured the image hasn't been in the office for a > while and I was finally able to ask him about the capture. He used > FTK Imager, but he doesn't know the exact version but it's 3.1.x. I > now know what the problem was/is with image. He told me that he was > only able to capture 4GB because of a limitation of the tool. Kind of > wish that information was passed on to me before I started working on > it. ;-D > > Also, Michael, your suggestion to use psscan did reveal some > processes. It looked rather small, and now I know why. > > Thanks for your help! > Carlos > > > On Sun, Apr 6, 2014 at 1:18 PM, Michael Ligh <michael.ligh(a)mnin.org> wrote: >> Hi Carlos, >> >> There are a few things going on. First, there's a bug in imageinfo which causes Volatility to crash when parsing the CPU addresses - I'll send you a fix for that separately, but it won't affect the rest of your analysis. >> >> When a KDBG structure can be found, but there are 0 processes and 0 modules, it almost always indicates a corrupt memory dump. In particular, the acquisition tool probably didn't acquire *all* physical memory ranges (or it failed to align them in the output file properly). Recently, I looked at a similar case where the virtual address of PsActiveProcessHead translated to a physical offset that was higher than the number of bytes in the memory dump (thus the memory dump file was truncated and missing some data). >> >> I'd be interested if psscan shows you a partial list of processes. If so, you may be able to perform limited analysis, by passing the physical offsets of the _EPROCESS structures to plugins like handles, dlllist, vaddump, etc (the -o/--offset option). >> >> Talk to you soon, >> MHL >> >> -------------------------------------------------- >> Michael Ligh (@iMHLv2) >> GPG: http://mnin.org/gpg.pubkey.txt >> Blog: http://volatility-labs.blogspot.com >> Training: http://memoryanalysis.net >> >> On Apr 6, 2014, at 2:29 PM, Andrew Case <atcuno(a)gmail.com> wrote: >> >>> Hello, >>> >>> Do you know which tool was used to acquire memory? Also, how much RAM >>> does the system have? >>> >>> Thanks, >>> Andrew (@attrc) >>> >>> On 4/2/2014 4:45 PM, Carlos Angeles wrote: >>>> Hello, >>>> >>>> I'm getting some KDBG errors when examining a Windows Server 2008 R2 >>>> server memory image. I saw a similar post to this list back in August >>>> 2012 (http://lists.volatilityfoundation.org/pipermail/vol-users/2012-August/00056…) >>>> >>>> Here's the output from a few plugins. It was captured by another >>>> person and I don't know what tool or version he used. >>>> >>>> Does it look like the memory image is corrupted? >>>> >>>> Thanks, >>>> Carlos >>>> >>>> >>>> $ vol.py -f memdump.mem imageinfo >>>> Volatility Foundation Volatility Framework 2.3.1 >>>> Determining profile based on KDBG search... >>>> >>>> Suggested Profile(s) : Win7SP0x64, Win7SP1x64, >>>> Win2008R2SP0x64, Win2008R2SP1x64 >>>> AS Layer1 : AMD64PagedMemory (Kernel AS) >>>> AS Layer2 : FileAddressSpace (memdump.mem) >>>> PAE type : No PAE >>>> DTB : 0x187000L >>>> KDBG : 0xf80001def0a0 >>>> Number of Processors : 8 >>>> Image Type (Service Pack) : 1 >>>> KPCR for CPU 0 : 0xfffff80001df0d00L >>>> Traceback (most recent call last): >>>> File "/usr/local/bin/vol.py", line 5, in <module> >>>> pkg_resources.run_script('volatility==2.3.1', 'vol.py') >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 183, in <module> >>>> main() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 174, in main >>>> command.execute() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", >>>> line 121, in execute >>>> func(outfd, data) >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", >>>> line 35, in render_text >>>> for k, v in data: >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", >>>> line 100, in calculate >>>> yield ('KPCR for CPU {0}'.format(kpcr.ProcessorBlock.Number), >>>> hex(kpcr.obj_offset)) >>>> TypeError: hex() argument can't be converted to hex >>>> $ >>>> $ >>>> $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 pslist >>>> Volatility Foundation Volatility Framework 2.3.1 >>>> Offset(V) Name PID PPID Thds Hnds >>>> Sess Wow64 Start Exit >>>> ------------------ -------------------- ------ ------ ------ -------- >>>> ------ ------ ------------------------------ >>>> ------------------------------ >>>> Traceback (most recent call last): >>>> File "/usr/local/bin/vol.py", line 5, in <module> >>>> pkg_resources.run_script('volatility==2.3.1', 'vol.py') >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 183, in <module> >>>> main() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 174, in main >>>> command.execute() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", >>>> line 121, in execute >>>> func(outfd, data) >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/taskmods.py", >>>> line 140, in render_text >>>> for task in data: >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", >>>> line 70, in pslist >>>> for p in get_kdbg(addr_space).processes(): >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", >>>> line 42, in processes >>>> raise AttributeError("Could not list tasks, please verify your >>>> --profile with kdbgscan") >>>> AttributeError: Could not list tasks, please verify your --profile with kdbgscan >>>> $ >>>> $ >>>> $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 kdbgscan >>>> Volatility Foundation Volatility Framework 2.3.1 >>>> ************************************************** >>>> Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) >>>> Offset (V) : 0xf80001def0a0 >>>> Offset (P) : 0x1def0a0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win7SP1x64 >>>> Version64 : 0xf80001def068 (Major: 15, Minor: 7601) >>>> Service Pack (CmNtCSDVersion) : 1 >>>> Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. >>>> PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) >>>> PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) >>>> KernelBase : 0xfffff80001c00000 (Matches MZ: True) >>>> Major (OptionalHeader) : 6 >>>> Minor (OptionalHeader) : 1 >>>> KPCR : 0xfffff80001df0d00 (CPU 0) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> >>>> ************************************************** >>>> Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) >>>> Offset (V) : 0xf80001def0a0 >>>> Offset (P) : 0x1def0a0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win2008R2SP1x64 >>>> Version64 : 0xf80001def068 (Major: 15, Minor: 7601) >>>> Service Pack (CmNtCSDVersion) : 1 >>>> Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. >>>> PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) >>>> PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) >>>> KernelBase : 0xfffff80001c00000 (Matches MZ: True) >>>> Major (OptionalHeader) : 6 >>>> Minor (OptionalHeader) : 1 >>>> KPCR : 0xfffff80001df0d00 (CPU 0) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> >>>> ************************************************** >>>> Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) >>>> Offset (V) : 0xf80001def0a0 >>>> Offset (P) : 0x1def0a0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win2008R2SP0x64 >>>> Version64 : 0xf80001def068 (Major: 15, Minor: 7601) >>>> Service Pack (CmNtCSDVersion) : 1 >>>> Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. >>>> PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) >>>> PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) >>>> KernelBase : 0xfffff80001c00000 (Matches MZ: True) >>>> Major (OptionalHeader) : 6 >>>> Minor (OptionalHeader) : 1 >>>> KPCR : 0xfffff80001df0d00 (CPU 0) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> >>>> ************************************************** >>>> Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) >>>> Offset (V) : 0xf80001def0a0 >>>> Offset (P) : 0x1def0a0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win7SP0x64 >>>> Version64 : 0xf80001def068 (Major: 15, Minor: 7601) >>>> Service Pack (CmNtCSDVersion) : 1 >>>> Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. >>>> PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) >>>> PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) >>>> KernelBase : 0xfffff80001c00000 (Matches MZ: True) >>>> Major (OptionalHeader) : 6 >>>> Minor (OptionalHeader) : 1 >>>> KPCR : 0xfffff80001df0d00 (CPU 0) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> KPCR : - (CPU -) >>>> $ >>>> $ >>>> $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 hivescan >>>> Volatility Foundation Volatility Framework 2.3.1 >>>> Offset(P) >>>> ------------------ >>>> 0x0000000000431010 >>>> 0x00000000051a4010 >>>> 0x000000000f1d7010 >>>> 0x0000000013e15410 >>>> 0x0000000015875410 >>>> 0x000000005a517410 >>>> 0x000000006e434410 >>>> 0x000000007ddce410 >>>> 0x00000000a143e410 >>>> 0x00000000a7f8c410 >>>> 0x00000000c3b83010 >>>> 0x00000000cbb17410 >>>> 0x00000000d0768410 >>>> $ >>>> $ >>>> $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 svcscan >>>> Volatility Foundation Volatility Framework 2.3.1 >>>> Traceback (most recent call last): >>>> File "/usr/local/bin/vol.py", line 5, in <module> >>>> pkg_resources.run_script('volatility==2.3.1', 'vol.py') >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script >>>> File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 183, in <module> >>>> main() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", >>>> line 174, in main >>>> command.execute() >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", >>>> line 121, in execute >>>> func(outfd, data) >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", >>>> line 360, in render_text >>>> for rec in data: >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", >>>> line 275, in calculate >>>> for task in tasks.pslist(addr_space): >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", >>>> line 70, in pslist >>>> for p in get_kdbg(addr_space).processes(): >>>> File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", >>>> line 42, in processes >>>> raise AttributeError("Could not list tasks, please verify your >>>> --profile with kdbgscan") >>>> AttributeError: Could not list tasks, please verify your --profile with kdbgscan >>>> _______________________________________________ >>>> Vol-users mailing list >>>> Vol-users(a)volatilityfoundation.org >>>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >>>> >>> _______________________________________________ >>> Vol-users mailing list >>> Vol-users(a)volatilityfoundation.org >>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >>

11 years, 2 months

1
0
0 0

Linux Memory Grabber/Volatility Linux Profile Builder

by Gibson, Ryan

Sorry for the SPAM if you already knew about this. https://github.com/halpomeranz/lmg Ryan Gibson CISSP, GCFA, GCIH, Security + Office: 858-651-1689 Mobile: 619-804-8736 Senior IT Security Engineer

11 years, 2 months

1
0
0 0

Syscan 2014 presentations are now out

by Andrew Case

Syscan 2014 was last week, and they have now released the slides and white papers from each speaker: http://syscan.org/index.php/download Reading through these presentations will be well worth your time no matter which role(s) you might play in security/forensics. -- Thanks, Andrew (@attrc)

11 years, 2 months

1
0
0 0

aquire RAM from Mac OSX 10.9?

by Thomas

Hi, which tool can be used to aquire a RAM dump from Mac OSX 10.9.x Mavericks? OSXPmem doesn't work. Thanks. Thomas

11 years, 2 months

2
1
0 0

KDBG errors

by Carlos Angeles

Hello, I'm getting some KDBG errors when examining a Windows Server 2008 R2 server memory image. I saw a similar post to this list back in August 2012 (http://lists.volatilityfoundation.org/pipermail/vol-users/2012-August/00056…) Here's the output from a few plugins. It was captured by another person and I don't know what tool or version he used. Does it look like the memory image is corrupted? Thanks, Carlos $ vol.py -f memdump.mem imageinfo Volatility Foundation Volatility Framework 2.3.1 Determining profile based on KDBG search... Suggested Profile(s) : Win7SP0x64, Win7SP1x64, Win2008R2SP0x64, Win2008R2SP1x64 AS Layer1 : AMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (memdump.mem) PAE type : No PAE DTB : 0x187000L KDBG : 0xf80001def0a0 Number of Processors : 8 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xfffff80001df0d00L Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", line 35, in render_text for k, v in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", line 100, in calculate yield ('KPCR for CPU {0}'.format(kpcr.ProcessorBlock.Number), hex(kpcr.obj_offset)) TypeError: hex() argument can't be converted to hex $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 pslist Volatility Foundation Volatility Framework 2.3.1 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/taskmods.py", line 140, in render_text for task in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", line 70, in pslist for p in get_kdbg(addr_space).processes(): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", line 42, in processes raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan") AttributeError: Could not list tasks, please verify your --profile with kdbgscan $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 kdbgscan Volatility Foundation Volatility Framework 2.3.1 ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP1x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP1x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP0x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP0x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 hivescan Volatility Foundation Volatility Framework 2.3.1 Offset(P) ------------------ 0x0000000000431010 0x00000000051a4010 0x000000000f1d7010 0x0000000013e15410 0x0000000015875410 0x000000005a517410 0x000000006e434410 0x000000007ddce410 0x00000000a143e410 0x00000000a7f8c410 0x00000000c3b83010 0x00000000cbb17410 0x00000000d0768410 $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 svcscan Volatility Foundation Volatility Framework 2.3.1 Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", line 360, in render_text for rec in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", line 275, in calculate for task in tasks.pslist(addr_space): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", line 70, in pslist for p in get_kdbg(addr_space).processes(): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", line 42, in processes raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan") AttributeError: Could not list tasks, please verify your --profile with kdbgscan

11 years, 2 months

3
2
0 0

Pid=1260 not founded through any plugin

by Nouman Zia

Hey, In images (tigger.vmem, sality.vmem and black energy) the connscan plugin gives an output which shows these images are making connection with some IP and also tells the PID of process which are making such connections but when I used PSLIST, PSSCAN and PSXVIEW plugins then none of them shows the process which is having such PID(which is making connection). P.S: In all the above mentioned images the process id is same i.e. PID=1260 So the problem is why its not showing any detail about PID=1260???

11 years, 2 months

3
2
0 0

help to investigate

by mediomen27

Hi, gmer has found something of suspicious. I have a screenshot of partial logs, here: http://postimg.org/image/bgx0u5xt9/ Now the server looks mysteriously clean thus the only clues I have are that screenshot and the vmware snapshot. Anyone could help me to investigate more deeply ? The following is what I have done alone: # vol pslist|grep logon Volatility Foundation Volatility Framework 2.3.1 0x8967d158 winlogon.exe 412 332 18 535 0 0 2013-06-26 09:16:14 UTC+0000 0x88ea0918 winlogon.exe 9088 332 19 258 1 0 2013-10-30 14:33:34 UTC+0000 # vol dlllist -p 412|grep -i klogon 0x10000000 0x36000 0x1 C:\WINDOWS\system32\klogon.dll klogon looks a kaspersky logon module # vol dlldump -b 0x10000000 -D /root/dumpprocess/ and the dumped dll looks really something about kaspersky.. # vol filescan|grep VC80 Volatility Foundation Volatility Framework 2.3.1 0x08d295d8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x08e684f0 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x08f0b920 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x0905a530 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x090822d0 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09175a90 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x09181e50 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09496250 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09509cc8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09555808 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcr80.dll 0x0958f860 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x095cd168 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x095f76a0 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x0960b668 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x0961d9d8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x0961e6c8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x096cda10 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x096f1db0 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x096f2d10 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x097c52d0 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x097fbb10 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09809e90 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09836350 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09843c68 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x0985aa50 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09872738 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x0987b340 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09a0fea8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x09a3ada8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x09a82f90 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x09bf9ef8 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86 0x09d95428 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 0x09dadd18 1 1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952 Thanks for any help.

11 years, 2 months

2
3
0 0

Memory forensics training by the Volatility Team is going to Australia!

by Andrew Case

We are happy to announce that we will be bringing our memory forensics and malware analysis training to Australia in August: http://www.memoryanalysis.net/#!New-Event-in-Canberra-AU-August-24th---29th… For information on the course please see: http://www.memoryanalysis.net/#!memory-forensics-training/c1q3n You can also find a number of past reviews of the course here: http://www.memoryanalysis.net/#!testimonials/c1dos This is the only time we will be in Australia until at least 2015, and we have already received significant interest in this offering so please contact us as soon as possible if you would like to attend. Thanks, Andrew (@attrc)

11 years, 2 months

1
0
0 0

windows 8 ?

by mediomen27

Hi, where can I download volatility 2.4 for windows 8 ? Thank you very much.

11 years, 2 months

2
1
0 0

Volatility pleads ignorance (aka "Nope, that window's not there")

by Bridgey

Hi all, I have an interesting scenario where Volatility seems to be telling me a process isn't there. Using Volatility 2.3.1, memory sample is from Win7SP1x86 (in a virtualbox VM) with pagefile turned off and 512MB RAM. Win7SP1x86.png (attached) clearly shows the Win7 desktop with notepad open and DumpIt.exe running. Output from pslist shows: $ python volatility-read-only/vol.py -f memdumps/MEMTEST-PC-20140331-131312/*.raw --profile=Win7SP1x86 pslist Volatility Foundation Volatility Framework 2.3.1 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0x839afa20 System 4 0 79 437 ------ 0 2014-03-31 13:12:08 UTC+0000 0x84836278 smss.exe 268 4 2 29 ------ 0 2014-03-31 13:12:08 UTC+0000 0x84f1b5c0 csrss.exe 344 336 8 333 0 0 2014-03-31 13:12:12 UTC+0000 0x84ef7d40 wininit.exe 380 336 4 79 0 0 2014-03-31 13:12:12 UTC+0000 0x84ef67a0 csrss.exe 392 372 7 187 1 0 2014-03-31 13:12:12 UTC+0000 0x84f04030 winlogon.exe 432 372 5 115 1 0 2014-03-31 13:12:13 UTC+0000 0x84e5fa80 services.exe 460 380 15 183 0 0 2014-03-31 13:12:13 UTC+0000 0x84f4d818 lsass.exe 468 380 7 444 0 0 2014-03-31 13:12:13 UTC+0000 0x84f4e7f8 lsm.exe 476 380 10 142 0 0 2014-03-31 13:12:13 UTC+0000 0x84fd6bc0 svchost.exe 596 460 14 353 0 0 2014-03-31 13:12:15 UTC+0000 0x84fe2af0 VBoxService.ex 660 460 11 107 0 0 2014-03-31 13:12:16 UTC+0000 0x84ff7bb0 svchost.exe 712 460 11 229 0 0 2014-03-31 13:12:16 UTC+0000 0x85127858 svchost.exe 760 460 16 341 0 0 2014-03-31 13:12:17 UTC+0000 0x85197cc8 svchost.exe 888 460 21 433 0 0 2014-03-31 13:12:19 UTC+0000 0x851cf510 svchost.exe 936 460 45 796 0 0 2014-03-31 13:12:20 UTC+0000 0x847fe030 svchost.exe 1036 460 16 244 0 0 2014-03-31 13:12:21 UTC+0000 0x8511b388 svchost.exe 1128 460 17 350 0 0 2014-03-31 13:12:22 UTC+0000 0x851fe390 spoolsv.exe 1232 460 12 287 0 0 2014-03-31 13:12:23 UTC+0000 0x85212c30 svchost.exe 1268 460 24 316 0 0 2014-03-31 13:12:23 UTC+0000 0x852e3030 taskhost.exe 1744 460 10 173 1 0 2014-03-31 13:12:29 UTC+0000 0x852f2bc8 dwm.exe 1816 888 5 73 1 0 2014-03-31 13:12:30 UTC+0000 0x852f39d0 explorer.exe 1828 1788 34 876 1 0 2014-03-31 13:12:30 UTC+0000 0x84fe16d0 VBoxTray.exe 1940 1828 11 94 1 0 2014-03-31 13:12:32 UTC+0000 0x85335a48 GrooveMonitor. 1948 1828 4 96 1 0 2014-03-31 13:12:32 UTC+0000 0x84f34030 SearchIndexer. 1092 460 14 683 0 0 2014-03-31 13:12:40 UTC+0000 0x8537ad40 notepad.exe 1164 1828 1 64 1 0 2014-03-31 13:12:42 UTC+0000 0x8527fd40 SearchProtocol 1848 1092 8 275 0 0 2014-03-31 13:12:43 UTC+0000 0x853a08a0 SearchFilterHo 1780 1092 5 80 0 0 2014-03-31 13:12:43 UTC+0000 0x84eed030 DumpIt.exe 1844 1828 2 37 1 0 2014-03-31 13:13:12 UTC+0000 0x85104638 conhost.exe 540 392 2 58 1 0 2014-03-31 13:13:12 UTC+0000 notepad.exe can be seen: PID = 1164. Parent process is explorer and session is 1 - just as I'd expect. However, when I ran the windows plugin there was no sign of notepad in the output (windows.txt attached). Further, using the screenshot plugin it shows exactly what I'd expect except the notepad process is missing! (session_1.WinSta0.Default.png attached). If anybody has any ideas as to why this situation occurs I'd be really interested. A 7z'd version of the dump is only 82MB and it doesn't contain anything sensitive so I can make it available if needs be.

11 years, 2 months

2
3
0 0

linux syscall table

by mediomen27

Hi, I am trying to make some check on a linux server with kernel 2.6.18. I am not a kernel developer so I don't know if what I am going to say is wrong...anyway. # ./vol.py -f /root/image_mem/AAA.lime --profile=LinuxAAAx86 linux_check_syscall Volatility Foundation Volatility Framework 2.3.1 Table Name Index Address Symbol ---------- ---------- ---------- ------------------------------ 32bit 0x0 0xc0430543 sys_restart_syscall 32bit 0x1 0xc0428888 sys_exit 32bit 0x2 0xc0403190 sys_fork 32bit 0x3 0xc0478826 sys_read ..... SNIP 32bit 0xe 0xc04872bf sys_mknod 32bit 0xf 0xc0476cb8 sys_chmod 32bit 0x10 0xc043cef7 sys_lchown16 32bit 0x11 0xc0437304 compat_sys_futex 32bit 0x12 0xc04808e0 sys_stat 32bit 0x13 0xc047873f sys_lseek 32bit 0x14 0xc042e69f sys_getpid ..... SNIP 32bit 0x13f 0xc0437304 compat_sys_futex 32bit 0x140 0xc0437304 compat_sys_futex 32bit 0x141 0xc0437304 compat_sys_futex 32bit 0x142 0xc0437304 compat_sys_futex 32bit 0x143 0xc049e91f sys_eventfd 32bit 0x144 0xc047691d sys_fallocate 32bit 0x145 0xc0437304 compat_sys_futex 32bit 0x146 0xc0437304 compat_sys_futex 32bit 0x147 0xc0437304 compat_sys_futex 32bit 0x148 0xc0437304 compat_sys_futex 32bit 0x149 0xc0437304 compat_sys_futex 32bit 0x14a 0xc0437304 compat_sys_futex 32bit 0x14b 0xc0437304 compat_sys_futex 32bit 0x14c 0xc0437304 compat_sys_futex 32bit 0x14d 0xc0437304 compat_sys_futex 32bit 0x14e 0xc0437304 compat_sys_futex 32bit 0x14f 0xc0437304 compat_sys_futex 32bit 0x150 0xc0437304 compat_sys_futex 32bit 0x151 0xc05be378 sys_recvmmsg What is this compat_sys_futex ??? I don't find anything like that on kernel source linux-2.6.18/arch/i386/kernelsyscall_table.S compat_sys_futex 32bit 0xf 0xc0476cb8 sys_chmod 32bit 0x10 0xc043cef7 sys_lchown16 32bit 0x11 0xc0437304 compat_sys_futex 32bit 0x12 0xc04808e0 sys_stat 32bit 0x13 0xc047873f sys_lseek should be sys_ni_syscallall .long sys_chmod /* 15 */ .long sys_lchown16 .long sys_ni_syscall /* old break syscall holder */ .long sys_stat .long sys_lseek but... # ./vol.py -f /root/image_mem/AAA.lime --profile=LinuxAAAx86 linux_check_syscall | grep compat_sys_futex | wc -l Volatility Foundation Volatility Framework 2.3.1 41 # and $ grep sys_ni_syscall syscall_table.S | wc -l 21 ?!?!? Anyone have enough patience to explain me this anomaly ? Or this is a syscall hijacking ? An other question... Is it normal that in the idt is missing "double fault" ?? # ./vol.py -f /root/image_mem/AAA.lime --profile=LinuxAAAx86 linux_check_idt Volatility Foundation Volatility Framework 2.3.1 Index Address Symbol ---------- ---------- ------------------------------ 0x0 0xc0405a7c divide_error 0x1 0xc0625498 debug 0x2 0xc0405b14 nmi 0x3 0xc06254dc int3 0x4 0xc0405c04 overflow 0x5 0xc0405c10 bounds 0x6 0xc0405c1c invalid_op 0x7 0xc0405adc device_not_available 0x9 0xc0405c28 coprocessor_segment_overrun 0xa 0xc0405c34 invalid_TSS 0xb 0xc0405c40 segment_not_present 0xc 0xc0405c4c stack_segment 0xd 0xc0625500 general_protection 0xe 0xc062550c page_fault 0xf 0xc0405c74 spurious_interrupt_bug 0x10 0xc0405ac4 coprocessor_error 0x11 0xc0405c58 alignment_check 0x12 0xc0405c64 machine_check 0x13 0xc0405ad0 simd_coprocessor_error 0x80 0xc0404f04 system_call where is 0x8 ? Thank you very much.

11 years, 3 months

2
2
0 0

Output from windows/wintree plugins - what does it mean?

by Bridgey

Hi all, In my continuing exploration of Windows memory and Volatility I'm current looking at Windows, literally, the GUI. Looking at a notepad process, wintree shows me: .Untitled - Notepad (visible) notepad.exe:100 Notepad ..#20128 notepad.exe:100 6.0.7601.17514!msctls_statusbar32 ..#20126 (visible) notepad.exe:100 6.0.7601.17514!Edit .Default IME notepad.exe:100 IME .MSCTFIME UI notepad.exe:100 MSCTFIME UI So, I'm assuming #20128 is the status bar at the bottom of the Notepad window, and #20126 is the edit control, that is, the textarea into which the user types. This is the corresponding output from the windows plugin for the edit control: Window Handle: #20126 at 0xfea0dc70, Name: ClassAtom: 0xc119, Class: 6.0.7601.17514!Edit SuperClassAtom: 0xc018, SuperClass: Edit pti: 0xfe2a4008, Tid: 1692 at 0x8550d368 ppi: 0xffa95550, Process: notepad.exe, Pid: 100 Visible: Yes Left: 10, Top: 52, Bottom: 485, Right: 701 Style Flags: WS_VSCROLL,WS_CHILD,WS_OVERLAPPED,WS_VISIBLE,WS_HSCROLL ExStyle Flags: WS_EX_CLIENTEDGE,WS_EX_LTRREADING,WS_EX_RIGHTSCROLLBAR,WS_EX_LEFT Window procedure: 0x744399d0 Question 1: Window Handle: #20126 at 0xfea0dc70 - what is the offset? Physical, virtual? Of what? The Edit control object? (I'm guessing: physical, yes, of the edit control object.) Question 2: I can see that it's Window-esque properties (X, Y, width, height, style flags, et al) are all clearly present., but where can I find information specific to this control (in this instance, an 'Edit'). For example, maybe the text it contains? (I'm guessing, take a look at 0xfea0dc70 and there'll be some kind of structure to parse.) As always, many thanks. (This is all going towards a plugin that I'm hoping to write!) Also as always, if I could've found this information on my own, please let me know where to look. I've read the Command Reference and the associated MoVP posts. Adam

11 years, 3 months

3
6
0 0

Can not use Volatility through Firewire

by Sebastian Biedermann

Hello guys, I'm trying to use Volatility through Firewire, but actually it's not working. My investigator PC runs Ubuntu Linux Ubuntu 12.04 I'm using the New (JuJu) Firewire stack compiled into kernel and I also installed forensic1394. My Firewire Bus is up and connected to a Firewire Bus on a target win7 system (4GB memory), I can successfully dump the memory with another tool called 'inception'. However, output only says: vol# python vol.py -l firewire://forensic1394/0 --profile=Win7SP1x64 modules Volatility Foundation Volatility Framework 2.3.1 No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareSnapshotFile: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space FileAddressSpace: Location is not of file scheme ArmAddressSpace: No base Address Space What I am doing wrong? Thank you! -- Sebastian

11 years, 3 months

2
3
0 0

dumping registry hives from memory images

by Roger

Hello Jamie, Apologies for delayed response. Had a short break with family. I tried using dumpfiles plugins as per your adviced. it turned out working against winxp, but seems not against win7sp1x86. is this a known limitation? Thanks again mate. Regards, Roger On Feb 18, 2014, at 5:00 AM, vol-users-request(a)volatilityfoundation.org wrote: > Send Vol-users mailing list submissions to > vol-users(a)volatilityfoundation.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > or, via email, send a message with subject or body 'help' to > vol-users-request(a)volatilityfoundation.org > > You can reach the person managing the list at > vol-users-owner(a)volatilityfoundation.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Vol-users digest..." > > > Today's Topics: > > 1. dumping registry hive(s) from memory image (Roger) > 2. Re: dumping registry hive(s) from memory image (Jamie Levy) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 17 Feb 2014 16:53:01 +1100 > From: Roger <roger.franklin67(a)gmail.com> > Subject: [Vol-users] dumping registry hive(s) from memory image > To: "vol-users(a)volatilityfoundation.org" <vol-users(a)volatilityfoundation.org> > Message-ID: <98444CAC-D5F0-473B-88EB-75CC983F2869(a)gmail.com> > Content-Type: text/plain; charset=us-ascii > > I've been trying to get/dump a copy of a certain registry hive from the memory. Managed to list down their offsets using hivelist plugin but unable to find ways of dumping them to files. My intention is to load it to other tools such as regripper as input/target registry files. > > Has any one found a way of doing it? > > Thank you very much in advance. > > Kind regards, > Roger > > ------------------------------ > > Message: 2 > Date: Mon, 17 Feb 2014 10:22:32 -0500 > From: Jamie Levy <jamie.levy(a)gmail.com> > Subject: Re: [Vol-users] dumping registry hive(s) from memory image > To: vol-users(a)volatilityfoundation.org > Message-ID: <53022938.4040302(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Roger, > > Try using the dumpfiles plugin: > > http://code.google.com/p/volatility/wiki/CommandReference23#dumpfiles > > You can use an example similar to the event logs one in order to dump > the registry file. Let me know if you need help. > > All the best, > > -Jamie > > > > On 2/17/2014 12:53 AM, Roger wrote: >> I've been trying to get/dump a copy of a certain registry hive from the memory. Managed to list down their offsets using hivelist plugin but unable to find ways of dumping them to files. My intention is to load it to other tools such as regripper as input/target registry files. >> >> Has any one found a way of doing it? >> >> Thank you very much in advance. >> >> Kind regards, >> Roger_______________________________________________ >> Vol-users mailing list >> Vol-users(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > > -- > Jamie Levy (@gleeda) > Blog: http://volatility-labs.blogspot.com/ > GPG: http://pgp.mit.edu/pks/lookup?op=get&search=0x196B2AB527A4AC92 > Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 > > > ------------------------------ > > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > > > End of Vol-users Digest, Vol 68, Issue 6 > ****************************************

11 years, 3 months

2
1
0 0

Are Volatility's Win7 profiles correct for Home Premium 32 bit?

by Andy Bellman

Michael and Jamie, Thanks. I've I found I made a couple of stupid mistakes. The second was sending the below message to the wrong email when I figured out the first late yesterday evening. My apologies, I've figured out that it was 64 bit, and I was completely mistaken about it being 32 bit. I assumed that it was 32 bit, because the the 64 bit profiles took much longer to run, and I'd assumed they were hanging. I think I used a slow computer, and suspect that having everything on usb also slowed things down. I decided I ought to check my work better, and let imageinfo run for the three hours it needed. In hindsight, I think I should have run hibinfo instead, as that seems to have indicated the right profile much faster. I think I can figure the rest out. Thank you, andybellman(a)outlook.com

11 years, 3 months

2
1
0 0

Issue with 'linux_pslist'

by Torres, Geoff (Global Cyber Security)

Hi All, This is an FYI to the maintainers of the Volatility code. I don't need immediate help on this issue but I thought somebody might be interested. I ran into a problem where the 'linux_pslist' command in volatility is hanging on an Ubuntu 13.04 memory dump. All the other 'ps' related commands seem to run just fine. I'm running Volatility 2.3.1 and I can supply any other details you need (including the memory dump). I've attached the debug output (I let it run for over 30 minutes on a 1GB dump). I'm happy to try any suggestions you may have. Thanks for a great product, Geoff ============================== Geoff Torres - HP ==============================

11 years, 3 months

2
1
0 0

Are Volatility's Win7 profiles correct for Home Premium 32 bit?

by Andy Bellman

Members of the list, I have been attempting to recover some unsaved files from a hiberfil.sys from a Windows 7 system. It is from a laptop, I'm pretty sure running Home Premium 32 bit. I use an XP system to run the standalone version of Volatility. Using 'volatility -f hiberfil.sys --profile=Win7SP0x86 imageinfo' I get: ' Suggested Profile(s) : No suggestion (Instantiated with Win7SP0x86) AS Layer1 : IA32PagedMemoryPae (Kernel AS) AS Layer2 : WindowsHiberFileSpace32 (Unnamed AS) AS Layer3 : FileAddressSpace (I:\hfr\hiberfil.sys) PAE type : PAE DTB : 0x0L KUSER_SHARED_DATA : 0xffdf0000L' Using 'volatility -f hiberfil.sys --profile=Win7SP1x86 hibinfo' I get: 'Volatility Foundation Volatility Framework 2.3.1 PO_MEMORY_IMAGE: Signature: HIBR SystemTime: 1970-01-01 00:00:00 UTC+0000 Control registers flags CR0: 00000000 CR0[PAGING]: 0 CR3: 00000000 CR4: 00000000 CR4[PSE]: 0 CR4[PAE]: 0 Windows Version is -.- (-)' Other modules seem to hang, or produce no results. I thought I must have a bad file, but I got it from the right place, and changing the name or location doesn't seem easy enough that an OEM would do it. I thought I might be using the tool wrong, but it seems I can get it working better with four out of the five NIST samples linked from the code.google.com/p/volatility/wiki website. I'm wondering if trying to do something volatility doesn't support yet, or if I am simply making a mistake. Thanks, andybellman(a)outlook.com

11 years, 3 months

3
2
0 0

Recovering OpenVPN credentials

by Philip Huppert

Hi, as part of a university course I've developed a Volatility plugin to extract user credentials cached in an OpenVPN process. Currently the extraction is limited to OpenVPN 2.2.2 on Windows. Still, maybe this is useful to someone else. Code is here: https://github.com/Phaeilo/vol-openvpn Philip

11 years, 3 months

3
3
0 0

RE: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64

by Smelkovs, Konrads (London)

Hello Aaron and Michael, This is a machine with a very interesting file corruption case which is most likely malware. I used moonsol's DumpIt to acquire the image from a Win7 64bit SP1 machine with 8 gigs of ram. Here's the output of bin2dmp: bin2dmp - 1.0.20100405 - (Professional Edition - Single User Licence) Convert raw memory dump images into Microsoft crash dump files. Copyright (C) 2007 - 2010, Matthieu Suiche <http://www.msuiche.net> Copyright (C) 2009 - 2010, MoonSols <http://www.moonsols.com> User , () Initializing memory descriptors... Done. Looking for kernel variables... Done. Loading file... Done. Rewritting CONTEXT for Windbg... -> Context->SegCs at physical address 0x0000000006017F78 modified from 00 in o 10 -> Context->SegDs at physical address 0x0000000006017F7A modified from 00 in o 2b -> Context->SegEs at physical address 0x0000000006017F7C modified from 00 in o 2b -> Context->SegFs at physical address 0x0000000006017F7E modified from 00 in [0x000000021E600000 of 0x000000021E600000] MD5 = 2DF9C04AB34D820ACA56B201B1382A880x0000000006017F80 is already equal to 00 Total time for the conversion: 9 minutes 49 seconds.6017F82 modified from 00 in o 18 And here I tried loading the dump file in windbg 64 Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\ xxxx.dmp] Kernel Complete Dump File: Full address space is available Comment: 'Hibernation file converted with MoonSols Memory Toolkit' Symbol search path is: C:\windows\symbols;SRV*C:\windows\symbols*http://msdl.microsoft.com/downloa… Executable search path is: Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. *** WARNING: Unable to verify timestamp for Unknown_Module_8b4820ec`83485540 *** ERROR: Module load completed but symbols could not be loaded for Unknown_Module_8b4820ec`83485540 Debugger can not determine kernel base address Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.18229.amd64fre.win7sp1_gdr.130801-1533 Machine Name: Kernel base = 0xfffff800`02e1b000 PsLoadedModuleList = 0xfffff800`0305e6d0 Debug session time: Sun Mar 2 21:08:59.275 2014 (UTC + 0:00) System Uptime: 0 days 7:22:16.509 Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. *** WARNING: Unable to verify timestamp for Unknown_Module_8b4820ec`83485540 *** ERROR: Module load completed but symbols could not be loaded for Unknown_Module_8b4820ec`83485540 Debugger can not determine kernel base address Loading Kernel Symbols Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. .Unable to read KLDR_DATA_TABLE_ENTRY at 00000140`248c8b48 - NTSTATUS 0xC0000147 Image path too long, possible corrupt data. Loading unloaded module list ..Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Missing image name, possible paged-out or corrupt data. .Image path too long, possible corrupt data. .Missing image name, possible paged-out or corrupt data. .Missing image name, possible paged-out or corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. ..Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. ..Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Missing image name, possible paged-out or corrupt data. ..Missing image name, possible paged-out or corrupt data. .Image path too long, possible corrupt data. ..Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. ..Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Missing image name, possible paged-out or corrupt data. .Image path too long, possible corrupt data. .Missing image name, possible paged-out or corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. .Image path too long, possible corrupt data. . WARNING: .reload failed, module list may be incomplete GetContextState failed, 0xD0000147 CS descriptor lookup failed GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get program counter GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4D415454, {1, 2, 3, 4} GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 ***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057. Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 00000140`248c8b48 - NTSTATUS 0xC0000147 WARNING: .reload failed, module list may be incomplete GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 Unable to get current machine context, NTSTATUS 0xC0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 00000140`248c8b48 - NTSTATUS 0xC0000147 WARNING: .reload failed, module list may be incomplete Unable to read NT module Base Name string at c48348ff`ffa3abe8 - NTSTATUS 0xC0000141 Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 00000140`248c8b48 - NTSTATUS 0xC0000147 WARNING: .reload failed, module list may be incomplete Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE ) Followup: MachineOwner --------- GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 GetContextState failed, 0xD0000147 -----Original Message----- From: AAron Walters [mailto:awalters@4tphi.net] Sent: 02 March 2014 20:50 To: Smelkovs, Konrads (London) Cc: Michael Ligh Subject: RE: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64 Hi Konrads, Nice to meet you. Thank for joining the mailing list. Is the machine you are trying to analyze part of an investigation or a test machine? A physical machine or a virtual machine? Does it have any unusual devices connected to it? If you convert the sample to windbg format using the MoolSols tools, will it load in windows debugger? Thanks, AAron Walters The Volatility Foundation On Sun, 2 Mar 2014, Smelkovs, Konrads (London) wrote: > Hi, > > Hangs on both Linux and Windows. I used MoonSol's memory acquisition tools. What tools would you suggest to use instead? > > > -----Original Message----- > From: Michael Ligh [mailto:michael.ligh@mnin.org] > Sent: 02 March 2014 16:25 > To: Smelkovs, Konrads (London) > Cc: vol-users(a)volatilityfoundation.org > Subject: Re: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64 > > Hi Konrads, > > Thanks for the output. At the moment, its looks like the page table is corrupt (based on the errors trying to read physical addresses in the range 0xf8b4c0575d000, which is way outside the size of your file). Whether the acquisition tool or Volatility's address space parser is to blame, I'm not currently sure. Can you answer a few additional questions, please: > > * Does it also hang on Linux also, or does it complete sometime after printing those "None object instantiated: Unable to read_long_long_phys" messages? > * What tool did you acquire memory with? Is it possible to re-acquire in a different format, such as a Windows crash dump? > > Thanks, > Michael > > > This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. > This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. > Any communications made with KPMG may be monitored and a record may be kept of any communication. > Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. > A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. > KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL. > This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL.

11 years, 3 months

3
3
0 0

Chasing evil or my tail?

by shorejsi2＠mmm.com

Working on a system that has been beaconing out to bad places and noticed this in the 'pstree' output (abbreviated): Name Pid PPid -------------------------------------------------- ------ ------ 0x894ca030:csrss.exe 580 484 ... 0x8f25b5b0:wininit.exe 632 484 ... . 0x8f379d40:services.exe 692 632 ... .. 0xb12484c0:FireSvc.exe 2064 692 ... .. 0xaecc6d40:svchost.exe 3332 692 ... ... .. 0xb3eeb030:svchost.exe 3780 692 ... .. 0x85e518e8:msdtc.exe 5332 692 ... ... 0x82651d40:explorer.exe 5400 5332 ... .... 0x85dcc3b0:pmcs.exe 1608 5400 ... .... 0x85dc9240:EpePcMonitor.e 6108 5400 ... .... 0x85c92030:BTTray.exe 4744 5400 ... .... 0x8652c928:iexplore.exe 7028 5400 ... ..... 0x86721030:iexplore.exe 7364 7028 ... ...... 0x866f2030:jp2launcher.ex 5356 7364 ... ....... 0x8678c408:java.exe 7700 5356 ... ... Is it just me or is msdtc.exe a very odd parent for explorer.exe? I would normally expect userinit.exe to start explorer and then exit, leaving it with no visible parent. Any input appreciated... -=[ Steve ]=-

11 years, 3 months

2
3
0 0

Volatility never finishes on 8 gig Win7SP1x64

by Smelkovs, Konrads (London)

Hello, C:\ >volatility-2.3.1.standalone.exe -f C:\image.raw kdbgscan --profile=Win7SP1x64 Volatility Foundation Volatility Framework 2.3.1 ..... Never finishes - analysing 8 gig dump, CPU max. Help? This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL.

11 years, 3 months

3
5
0 0

FW: Memory-mapped file and shared pages

by Joshua Davies

Hi list, I'm currently doing some memory analysis, and I'm using Notepad on Windows 7 x64 as an example. My question is this: is there any way to link a _FILE_OBJECT back to the process that generated it, without a valid handle, or an entry in the VAD tree. This article discusses it: http://computer.forensikblog.de/en/2009/04/linking-file-objects-to-processe… - however, this approach only works if there is a valid handle for the open file. Here's an example: I open notepad, and open a simple text file that contains "This is the contents of the file". Performing a scan over the memory dump reveals this data in two locations: 1 - 0x1448f000 - This is the contents of the file found through the _FILE_OBJECT->SectionObjectPointers->DataSectionObject. This points to a control area, and through that I can locate the Subsection-BasePTE which shows that the page is in transition and has a PFN of 0x1448f. So this allows me to the find the data through the _FILE_OBJECT 2 - 0x39d336b0 - This address is currently part of Notepad's private heap, which is where the data has been mapped into. So examining the two pages through WinDbg gives me this information: lkd> !pfn 1448f PFN 0001448F at address FFFFFA80003CDAD0 flink 00015B8F blink / share count 00013ED5 pteaddress FFFFF8A0008AD010 reference count 0000 used entry count 0000 Cached color 0 Priority 5 restore pte FA800325553004C0 containing page 00ABBA Standby P Shared lkd> !pte FFFFF8A0008AD010 1 VA fffff8a0008ad010PXE at FFFFF8A0008AD010 PPE at FFFFF8A0008AD010 PDE at FFFFF8A0008AD010 PTE at FFFFF8A0008AD010contains 000000001448F8C0not valid Transition: 1448f Protect: 6 - ReadWriteExecute As can be seen, the page containing the original data is shared, is on the standby list, and points to a prototype PTE. lkd> !pfn 39d33 PFN 00039D33 at address FFFFFA8000AD7990 flink 00039D88 blink / share count 00039D1E pteaddress FFFFF6800001CAC8 reference count 0000 used entry count 0000 Cached color 0 Priority 3 restore pte 1635500000080 containing page 0274B8 Standby lkd> !pte FFFFF6800001CAC8 1 VA fffff6800001cac8PXE at FFFFF6800001CAC8 PPE at FFFFF6800001CAC8 PDE at FFFFF6800001CAC8 PTE at FFFFF6800001CAC8contains 0000000000000000not valid The PTE within Notepad's heap is marked as not valid, but also shows that the page is on the standby list. As the page located through the FILE_OBJECT is marked as shared, and points to a prototype PTE, is there anyway of locating this prototype PTE, and using it to track back to Notepad? So for instance, would it be possible to locate the PPTE by searching memory for the 'MmSt' tag, and then parse the PPTE to gain any information. Or does the PPTE not track backwards in that way? Essentially, if the page containing the data found through the _FILE_OBJECT is shared, what is it shared with, and is it possible to track this information, using either the PFN database, prototype PTE entries, or something else I haven't thought of. Any input or advice would be appreciated. Thanks Josh.

11 years, 3 months

1
0
0 0

Volatility & Mac Malware Analysis at RSA

by Andrew Case

Hello All, I was writing to let everyone know that I will be speaking Friday at RSA on investigating Mac malware with Volatility and Volatility's Mac support in general. If you are going to the conference you should check out the talk and come say 'hi' after: http://www.rsaconference.com/speakers/andrew-case -- Thanks, Andrew (@attrc)

11 years, 3 months

1
0
0 0

Broke something =:o(

by shorejsi2＠mmm.com

C:\Volatility>python vol.py timeliner -f \CSATLCL\W0137018\W0137018-RAM.dd4.001 --profile=Win7SP1x86 Volatility Foundation Volatility Framework 2.3.1 Traceback (most recent call last): File "vol.py", line 184, in <module> main() File "vol.py", line 175, in main command.execute() File "C:\Volatility\volatility\commands.py", line 122, in execute func(outfd, data) File "C:\Volatility\volatility\plugins\timeliner.py", line 88, in render_text for line in data: File "C:\Volatility\volatility\plugins\timeliner.py", line 312, in calculate o) UnicodeEncodeError: 'ascii' codec can't encode character u'\xae' in position 156: ordinal not in range(128) Looks like I may have a martian character in a string somewhere... -=[ Steve ]=-

11 years, 3 months

1
0
0 0

Volatility Memory Forensics & Malware Analysis training now available on three continents!

by Andrew Case

Hello All, We are writing to announce that we now have public trainings scheduled in Australia, London, New York, and Virginia! The New York and London trainings will be selling out soon so we suggest contacting us ASAP if you wish to attend either of those. We have also already received significant interest in the Australia course and have a large notification list for it. Please contact us if you would like to be added. Finally, the team is happy to announce that we now have a dedicated website for training at http://www.memoryanalysis.net. For full information on each training and the new website, please see our recent blog post: http://volatility-labs.blogspot.com/2014/02/training-by-volatility-project-… If you want to to learn memory forensics skills from the researchers and developers behind Volatility then you should consider signing up for one of our courses. Not only will you leave being an expert in Volatility and Windows internals, but you will also be able to perform malware analysis and incident response along side the best in the industry. -- Thanks, Andrew (@attrc)

11 years, 3 months

1
0
0 0

dumping registry hive(s) from memory image

by Roger

I've been trying to get/dump a copy of a certain registry hive from the memory. Managed to list down their offsets using hivelist plugin but unable to find ways of dumping them to files. My intention is to load it to other tools such as regripper as input/target registry files. Has any one found a way of doing it? Thank you very much in advance. Kind regards, Roger

11 years, 4 months

2
1
0 0

Duqu Image

by Gibson, Ryan

Does anyone have one? Is there a writeup somewhere like there was for Stuxnet? Ryan Gibson GCFA, GCIH, Security + Office: 858-651-1689 Mobile: 619-804-8736 Senior IT Security Engineer

11 years, 4 months

2
2
0 0

Re: [Vol-users] Difficulty creating CentOS profiles

by Andrew Case

So was the fix just to switch to lime format or did you also need the patch? This will help us keep better documentation for future bug reports. Also, is there a reason you need the raw sample? If you are looking for a sample without any metadata, the best version would be 'padded' since it zero fills the offsets between RAM sections, but note that you can get a HUGE file, especially on 64 bit systems. The raw version of LiME simply concatantes regions together (does not pad), which make offsets found from virtual address translation off. This is why Volatility (and other tools) cannot process most raw Lime dumps. On 2/6/2014 10:45 AM, Torres, Geoff (Global Cyber Security) wrote: > OK, we're making progress... > > Michael Ligh also suggested that article. I had dismissed it as not applicable because it was regarding CentOS 5.3 and the earliest I've been attempting is 5.8. My apologies for not trying it sooner. > > It did work for the Lime format, but not the Raw format which is ultimately what I need. Would different offsets work for the raw format? Is it possible to convert a raw format image into Lime format? > > Also, does this mean that I need different volatility code for different kernels? > > My role is to perform forensic analysis on compromised systems. I can conceivably get any type of system and I get them in large enough volume that I've been developing scripts to automate these sort of tasks. > > Thanks for all your help so far, > > Geoff > > > -----Original Message----- > From: Andrew Case [mailto:atcuno@gmail.com] > Sent: Thursday, February 06, 2014 7:32 AM > To: Torres, Geoff (Global Cyber Security); 'vol-users(a)volatilityfoundation.org' > Subject: Re: [Vol-users] Difficulty creating CentOS profiles > > Hello, > > I believe you are having the same issues that we diagnosed here: > > http://lists.volatilityfoundation.org/pipermail/vol-users/2013-February/000… > > Could you please edit your code as MHL explains to account for the shift? It only requires two small changes to the existing code. Note that the line numbers may be different since the code has been update since then but if you search for the 0xffffffff80000000 number in each file you will be able to find it. > > Also we would recommend acquiring in the lime format "format=lime" > instead of acquiring in the raw one. > > Let me know how it goes. > > Thanks, > Andrew (@attrc) > > > On 2/5/2014 5:26 PM, Torres, Geoff (Global Cyber Security) wrote: >> Hi, >> >> >> >> I've been unable to create a working Linux profile for any version of >> CentOS. It compiles fine but gives a 'No suitable address space >> mapping found' error when ran against the memory image. >> >> >> >> I've been successful creating various Debian and Ubuntu profiles, but >> CentOS has yet to work. I'm sure it's something simple but I can't >> figure it out. I'm certain that I'm matching kernel versions >> correctly and that the build process is the same as I use for the Ubuntu versions. >> >> >> >> I've attached the details of my most recent attempt. It's a vanilla >> CentOS 5.10 install on VmWare. The memory image is available (250Mb >> zip) if necessary. >> >> >> >> Any ideas? None of the solutions I found in Google seem to address my >> issue. >> >> >> >> Thanks, >> >> >> >> Geoff >> >> >> >> BTW - I'm not a kernel programmer so please be detailed if there's >> something you'd like me to try. >> >> >> >> _______________________________________________ >> Vol-users mailing list >> Vol-users(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >> >

11 years, 4 months

2
1
0 0

Difficulty creating CentOS profiles

by Torres, Geoff (Global Cyber Security)

Hi, I've been unable to create a working Linux profile for any version of CentOS. It compiles fine but gives a 'No suitable address space mapping found' error when ran against the memory image. I've been successful creating various Debian and Ubuntu profiles, but CentOS has yet to work. I'm sure it's something simple but I can't figure it out. I'm certain that I'm matching kernel versions correctly and that the build process is the same as I use for the Ubuntu versions. I've attached the details of my most recent attempt. It's a vanilla CentOS 5.10 install on VmWare. The memory image is available (250Mb zip) if necessary. Any ideas? None of the solutions I found in Google seem to address my issue. Thanks, Geoff BTW - I'm not a kernel programmer so please be detailed if there's something you'd like me to try.

11 years, 4 months

2
1
0 0

Windows 7 _FILE_OBJECT allocations

by Joshua Davies

Hello list! I'm currently looking into the way in which _FILE_OBJECTS are created and handled by Windows 7, and I'm a little bit confused over something I've observed. When using notepad.exe to open a file, a file handle to the opened file never seems to get added to the object table within the _EPROCESS structure (monitored using SystemInternal's ProcExplorer). I believe this is because notepad does not leave the handle open, it simply opens the file, reads in the data, and then closes the file, without adding the file object to the handle table. However, after opening the file, if I dump the memory of the system (this is being performed on a VM), and use Volaility's filescan to scan for all _FILE_OBJECTS, I see that there is indeed still a _FILE_OBJECT associated with the file I opened. However it's handle count is zero. This makes sense, as with a handle count of zero, it shouldn't be listed in any of the handle tables for any processes. However, it's pointer, or reference count is still valid, often having 16 pointers. My question is this, if the handle count is zero, but the pointer/reference count is still valid, where is this _FILE_OBJECT actually being stored? Is there some kind of kernel-based list/table that holds these open references? Or is this _FILE_OBJECT just floating around in some kind of cache, waiting to be destroyed? Any input or advice would be greatly appreciated. Thanks

11 years, 4 months

2
1
0 0

Red Hat snapshot

by Katarzyna Olejnik

Hi everyone, I've got a snapshot from a Red Hat VM that I'd like to analyze. I've noticed that imagecopy is in the Windows section of the documentation. Is imagecopy supported for Linux snapshots? Thanks, Kasia Olejnik

11 years, 4 months

2
1
0 0

http://blog.handlerdiaries.com/?p=363

by jack crook

I case anyone is interested I wrote a blog post of the memory analysis I did on Jake Williams ADD tool he presented at Shmoocon. It can be found here http://blog.handlerdiaries.com/?p=363 Thanks, Jack Crook

11 years, 4 months

2
1
0 0

New Subreddit for Memory Forensics

by Gibson, Ryan

Hello All, I was poking around the reddits the other day and to my shock and utter dismay, I found no memory forensics subreddit. Soooooooo, I took it upon myself to create one. Volatility all the thingz! http://www.reddit.com/r/memoryforensics/ Ryan Gibson GCFA, GCIH, Security + Office: 858-651-1689 Mobile: 619-804-8736 Senior IT Security Engineer

11 years, 4 months

3
2
0 0

zeusscan2

by shorejsi2＠mmm.com

I'm dealing with what appears to be a new Zeus variant and on a whim I tried to run zeusscan2 under a copy of Volatility 2.0 I still hang onto. Perhaps not surprisingly, it ends unhappily Volatile Systems Volatility Framework 2.0 Traceback (most recent call last): File "vol.py", line 135, in <module> main() File "vol.py", line 126, in main command.execute() File "/home/a05p8zz/VolInstall/volatility-2.0/volatility/commands.py", line 101, in execute func(outfd, data) File "/home/a05p8zz/VolInstall/volatility-2.0/volatility/plugins/zeusscan2.py", line 330, in render_text for p, start, url, config_key, creds_key, decoded_config, decoded_magic in data: File "/home/a05p8zz/VolInstall/volatility-2.0/volatility/plugins/zeusscan2.py", line 221, in calculate data = malware.get_vad_data(ps_ad, start, end) File "/home/a05p8zz/VolInstall/volatility-2.0/volatility/plugins/malware.py", line 856, in get_vad_data return ''.join(pages_one) OverflowError: join() result is too long for a Python string Now I strongly suspect that the new variant is just enough different that it messes with the parsing and results in a runaway, but I just wanted to make sure I'm not leaving something on the table here... Should this work? -=[ Steve ]=-

11 years, 4 months

3
6
0 0

Re: [Vol-users] zeusscan2

by shorejsi2＠mmm.com

Stefan; Soon as I get my hands on the disk image I will gladly do so. -=[ Steve ]=- >> Are you willing/able to share the md5 of that Zeus variant, please? >> Cheers, >> Stefan.

11 years, 4 months

1
0
0 0

Create Linux Profile

by Chris

All, in the wiki [1] is described howto build a Linux profile. Why is a machine with the corresponding kernel / distribution required? Why aren't the kernel headers enough? - Chris [1] https://code.google.com/p/volatility/wiki/LinuxMemoryForensics

11 years, 4 months

2
1
0 0

Malfind and impscan questions

by Kathy Simmons

I have a memory dump of a Windows XP box with a piece of malware running in it. In the course of running malfind on the image, there are eight responses, two of which are below (A and B). After the malfind command, I run the impscan command to look at the imports: python vol.py impscan -p 820 -b 0x1f00000 python vol.py impscan -p 820 -b 0x01f50010 The response to the first impscan command is what I expected (see C below). The response to the second impscan command (see D below) is not what I expected at all - no imports? I also ran impscan on the address 0x01f50012 based on the results from the malfind command (see D below) as I figured that I wanted to dump the dll starting on the beginning of the MZ header. But neither address produced any imports - I'm not sure where to go from here. I'm very new at this; any help would be greatly appreciated. My end goal is to take this piece of malware, which looks to have injected several dll's into a process, dump out each dll, then have them reverse engineered. Thanks- A. Process: xxxxxx.exe Pid: 820 Address: 0x1f00000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 9, PrivateMemory: 1, Protection: 6 0x01f00000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0x01f00010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0x01f00020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x01f00030 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 ................ 0x1f00000 4d DEC EBP 0x1f00001 5a POP EDX 0x1f00002 90 NOP 0x1f00003 0003 ADD [EBX], AL 0x1f00005 0000 ADD [EAX], AL 0x1f00007 000400 ADD [EAX+EAX], AL 0x1f0000a 0000 ADD [EAX], AL 0x1f0000c ff DB 0xff 0x1f0000d ff00 INC DWORD [EAX] 0x1f0000f 00b800000000 ADD [EAX+0x0], BH 0x1f00015 0000 ADD [EAX], AL 0x1f00017 004000 ADD [EAX+0x0], AL 0x1f0001a 0000 ADD [EAX], AL 0x1f0001c 0000 ADD [EAX], AL 0x1f0001e 0000 ADD [EAX], AL 0x1f00020 0000 ADD [EAX], AL 0x1f00022 0000 ADD [EAX], AL 0x1f00024 0000 ADD [EAX], AL 0x1f00026 0000 ADD [EAX], AL 0x1f00028 0000 ADD [EAX], AL 0x1f0002a 0000 ADD [EAX], AL 0x1f0002c 0000 ADD [EAX], AL 0x1f0002e 0000 ADD [EAX], AL 0x1f00030 0000 ADD [EAX], AL 0x1f00032 0000 ADD [EAX], AL 0x1f00034 0000 ADD [EAX], AL 0x1f00036 0000 ADD [EAX], AL 0x1f00038 0000 ADD [EAX], AL 0x1f0003a 0000 ADD [EAX], AL 0x1f0003c c8000000 ENTER 0x0, 0x0 B. Process: XXXXXX.exe Pid: 820 Address: 0x1f50000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 59, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x01f50000 4c 1b cd 25 00 00 09 e8 16 4f 9e 7e cd 25 00 00 L..%.....O.~.%.. 0x01f50010 00 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff ..MZ............ 0x01f50020 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 ..........@..... 0x01f50030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x1f50000 4c DEC ESP 0x1f50001 1bcd SBB ECX, EBP 0x1f50003 25000009e8 AND EAX, 0xe8090000 0x1f50008 16 PUSH SS 0x1f50009 4f DEC EDI 0x1f5000a 9e SAHF 0x1f5000b 7ecd JLE 0x1f4ffda 0x1f5000d 2500000000 AND EAX, 0x0 *0x1f50012 4d DEC EBP0x1f50013 5a POP EDX* 0x1f50014 90 NOP 0x1f50015 0003 ADD [EBX], AL 0x1f50017 0000 ADD [EAX], AL 0x1f50019 000400 ADD [EAX+EAX], AL 0x1f5001c 0000 ADD [EAX], AL 0x1f5001e ff DB 0xff 0x1f5001f ff00 INC DWORD [EAX] 0x1f50021 00b800000000 ADD [EAX+0x0], BH 0x1f50027 0000 ADD [EAX], AL 0x1f50029 004000 ADD [EAX+0x0], AL 0x1f5002c 0000 ADD [EAX], AL ................. ................ C. python vol.py impscan -p 9820 -b 0x01f00000 Volatility Foundation Volatility Framework 2.3.1 IAT Call Module Function ------------------ ------------------ -------------------- -------- 0x0000000001f07d10 0x0000000076cf2c70 kernel32.dll HeapFree 0x0000000001f07d18 0x0000000076cf2d60 kernel32.dll GetProcessHeap 0x0000000001f07d20 0x0000000076e41b70 kernel32.dll HeapAlloc D. python vol.py impscan -p 820 -b 0x01f50010 Volatility Foundation Volatility Framework 2.3.1 IAT Call Module Function ------------------ ------------------ -------------------- -------- E. python vol.py impscan -p 820 -b 0x01f50012 Volatility Foundation Volatility Framework 2.3.1 IAT Call Module Function ------------------ ------------------ -------------------- --------

11 years, 4 months

2
1
0 0

Plugin ethscan problem

by Thomas

Hi, Happy New Year! :) I tried to explore the contest plugin ethscan (latest release) on a few different memory samples containing Mac OSX and Linux OS without success. Each time I got an error message like: ERROR : volatility.commands : This command does not support the profile MacMountainLion_10_8_3_AMDx64 I'm using the correct OS profile, downloaded from the Volatility site (MacProfilesAll.zip) and https://github.com/KDPryor/LinuxVolProfiles. Other Volatility commands like mac_dmesg or linux_netstat does work correctly, so the Profile should really match. Volatility: current SVN revision 3573. Memory samples from: Mac OSX 10.8.3 x64 from Volatility download page OSX 10.7.5 (not 10.7.3) from osxreverser, found on Twitter: https://twitter.com/osxreverser/status/344521006288891905 Ubuntu 10.04 http://files.sempersecurus.org/dumps/memory/pexit.zip found on this interesting blog: http://sempersecurus.blogspot.de/2013/12/a-forensic-overview-of-linux- perlbot.html ethscan does work correctly when using different Windows dumps. How can I fix this problem and get ethscan work also on OSX and Linux dumps? Thanks! Thomas

11 years, 5 months

1
0
0 0

Additional assist with hidden PID's

by James Lay

Hey all, Here's what I have: Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ---------- -------------------- ------ ------ ------ -------- ------ ----- ------- -------- 0x26004da0 UPS_Label_23052 396 False True False False False False False 0x260f7da0 UPS_Label_23052 396 False True False False False False False Offset(P) Name PID PPID PDB Time created Time exited ---------- ---------------- ------ ------ ---------- ------------------------------ ------------------------------ 0x27808020 explorer.exe 1480 1412 0x0a440200 2013-05-23 17:44:24 UTC+0000 0x26004da0 UPS_Label_23052 396 1480 0x0a4403c0 2013-05-23 17:46:09 UTC+0000 0x260f7da0 UPS_Label_23052 396 1480 0x0a4403c0 2013-05-23 17:46:09 UTC+0000 I'm attempting to find and extract the running UPS_Label_23052, but having difficulty extracting the exe from it. Procmemdump and procexedump fail to find the pid, so I'm kind of lost. Any info would help...thank you. James

11 years, 6 months

2
2
0 0

OSX 10.9 memory acquisition

by Sebastien Bourdon-Richard

Hey all, Is there any tools available to acquire OSX 10.9 memory? Mac memory reader does not work on 10.9. Thanks in advance, Sebastien

11 years, 6 months

3
4
0 0

Extracting a running dll from a process

by James Lay

So here's what I got...regsvr32.exe was run as soon below: Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0x893614e0 regsvr32.exe 3100 2564 5 97 0 0 2013-12-06 18:28:51 UTC+0000 Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ---------- -------------------- ------ ------ ------ -------- ------ ----- ------- -------- 0x093614e0 regsvr32.exe 3100 True True False True True True False regsvr32.exe pid: 3100 Command line : regsvr32.exe "C:\Documents and Settings\user\Local Settings\Application Data\YrqdPack\normalPaddlg.dll" Service Pack 3 Base Size LoadCount Path ---------- ---------- ---------- ---- 0x10000000 0x9000 0x1 C:\Documents and Settings\user\Local Settings\Application Data\YrqdPack\normalPaddlg.dll I'm dumped pid 3100 to a dmp file with procmemdump. I strings 3100.dmp and I see what I'm looking for (domain names that match a packet capture). I'm trying to extract that running dll from the 3100.dmp file, which is around 200 megs. Any help would be awesome..thank you. James

11 years, 6 months

2
4
0 0

Re: [Vol-users] Help to add new plugin

by Jamie Levy

Oh, also if you copied the ethscan plugin to your volatility/plugins directory, don't use the --plugins option -----Original Message----- From: David <eterno.comandante(a)gmail.com> Date: Thu, 14 Nov 2013 13:53:05 To: Jamie Levy<jamie.levy(a)gmail.com> Cc: Volatility List<vol-users(a)volatilesystems.com> Subject: Re: [Vol-users] Help to add new plugin Hi Jamie Thanks again... I executed "sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 ethscan” And i have new errors, (i use vol.py 2.3.1 non instalable version volatility 2.3.1) Do you know if has anybody a similar problem with ethscan plugin? Traceback (most recent call last): File "/usr/local/bin/vol.py", line 186, in <module> main() File "/usr/local/bin/vol.py", line 143, in main registry.register_global_options(config, commands.Command) File "/usr/local/lib/python2.7/dist-packages/volatility/registry.py", line 157, in register_global_options for m in get_plugin_classes(cls, True).values(): File "/usr/local/lib/python2.7/dist-packages/volatility/registry.py", line 152, in get_plugin_classes raise Exception("Object {0} has already been defined by {1}".format(name, plugin)) Exception: Object EthScan has already been defined by <class 'volatility.plugins.ethscan_rc1.EthScan'> Best regards El 14/11/2013, a las 12:45, Jamie Levy <jamie.levy(a)gmail.com> escribió: > Try: > > sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 ethscan > > First: --plugins takes in either a directory or a zipfile, not a plugin > > Second: You didn't specify which plugin to run (ethscan) > From: David <eterno.comandante(a)gmail.com> > Date: Thu, 14 Nov 2013 10:41:47 +0100 > To: Jamie Levy<jamie.levy(a)gmail.com> > Cc: Volatility List<vol-users(a)volatilesystems.com> > Subject: Re: [Vol-users] Help to add new plugin > > > Sorry I had a typo i didn´t write --profile=Win7SP1x64 > > >> sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 > > > > I have the same error of ever :( > >> Volatility Foundation Volatility Framework 2.3.1 >> ERROR : __main__ : You must specify something to do (try -h) > > > Thanks!! > > El 14/11/2013, a las 09:36, David <eterno.comandante(a)gmail.com> escribió: > >> Hi @Jamie and list >> >> Thanks very much for your support ;) >> >> I’ve same errors when i’m executing: :( >> >> sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img >> >> The error: >> >> Volatility Foundation Volatility Framework 2.3.1 >> ERROR : __main__ : You must specify something to do (try -h) >> >> Maybe the cause of this error can be that the new plugin “ethscan" isn't compatible with non instalable version of volatility 2.3.1, what do you think about? >> >> On the other hand, i found a brief tutorial about ethscan: >> >> https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/README.t… >> >> vol.py ethscan -f be2.vmem -R --dump-dir outputfiles -C out.pcap -P -S >> >> The execution of the vol.py command is different……. :( >> >> He does not the flag —-plugin= >> >> Thanks for all!! >> >> Ps: My apologies for my level of english >> >> >> El 13/11/2013, a las 16:43, Jamie Levy <jamie.levy(a)gmail.com> escribió: >> >>> Hi David, >>> >>> I think you might have also asked this on the channel. So yes, you should use the `--plugins=/path/to/folder/with/ethscan` option, obviously changing the path to a folder that has that plugin. If you were the person on the channel, the issue that you were having is because you must specify `--plugins` first, BEFORE any other options to vol.py: >>> >>> http://code.google.com/p/volatility/wiki/VolatilityUsage23#Specifying_Addit… >>> >>> Let me know if you have any other questions. >>> >>> All the best, >>> >>> -gleeda >>> >>> >>> >>> >>> On Tue, Nov 12, 2013 at 6:42 AM, David Martin <eterno.comandante(a)gmail.com> wrote: >>> Hello list, >>> >>> Please, I need some help about for add/use new plugins in volatility 2.3.1. >>> >>> Can I use the flag "--plugins=contrib/plugins"? o is there any method? >>> >>> The plugin that I want for add/use is: >>> >>> https://code.google.com/p/jamaal-re-tools/source/checkout >>> >>> Thanks for your support!! >>> >>> >>> >>> >>> >>> _______________________________________________ >>> Vol-users mailing list >>> Vol-users(a)volatilesystems.com >>> http://lists.volatilesystems.com/mailman/listinfo/vol-users >>> >>> >>> >>> >>> -- >>> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 >> >

11 years, 6 months

2
6
0 0

How do I enable Mac profiles

by linux stuff

Hey Gang I'm a total noob with eForensics so I'm on the learning curve. I can get volitility to work on Windows memory images but not with Mac memory images. I've downloaded the Mac profiles, unzipped it and moves the files to the location indicated in the article, but when I run the info command the profiles aren't listed. Is there another step in the enable process? TIA Marty Sent from my iPad

11 years, 7 months

2
1
0 0

Re: [Vol-users] Help to add new plugin

by Jamie Levy

Type at the prompt: sudo make clean and try again -----Original Message----- From: David <eterno.comandante(a)gmail.com> Date: Thu, 14 Nov 2013 13:53:05 To: Jamie Levy<jamie.levy(a)gmail.com> Cc: Volatility List<vol-users(a)volatilesystems.com> Subject: Re: [Vol-users] Help to add new plugin Hi Jamie Thanks again... I executed "sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 ethscan” And i have new errors, (i use vol.py 2.3.1 non instalable version volatility 2.3.1) Do you know if has anybody a similar problem with ethscan plugin? Traceback (most recent call last): File "/usr/local/bin/vol.py", line 186, in <module> main() File "/usr/local/bin/vol.py", line 143, in main registry.register_global_options(config, commands.Command) File "/usr/local/lib/python2.7/dist-packages/volatility/registry.py", line 157, in register_global_options for m in get_plugin_classes(cls, True).values(): File "/usr/local/lib/python2.7/dist-packages/volatility/registry.py", line 152, in get_plugin_classes raise Exception("Object {0} has already been defined by {1}".format(name, plugin)) Exception: Object EthScan has already been defined by <class 'volatility.plugins.ethscan_rc1.EthScan'> Best regards El 14/11/2013, a las 12:45, Jamie Levy <jamie.levy(a)gmail.com> escribió: > Try: > > sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 ethscan > > First: --plugins takes in either a directory or a zipfile, not a plugin > > Second: You didn't specify which plugin to run (ethscan) > From: David <eterno.comandante(a)gmail.com> > Date: Thu, 14 Nov 2013 10:41:47 +0100 > To: Jamie Levy<jamie.levy(a)gmail.com> > Cc: Volatility List<vol-users(a)volatilesystems.com> > Subject: Re: [Vol-users] Help to add new plugin > > > Sorry I had a typo i didn´t write --profile=Win7SP1x64 > > >> sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 > > > > I have the same error of ever :( > >> Volatility Foundation Volatility Framework 2.3.1 >> ERROR : __main__ : You must specify something to do (try -h) > > > Thanks!! > > El 14/11/2013, a las 09:36, David <eterno.comandante(a)gmail.com> escribió: > >> Hi @Jamie and list >> >> Thanks very much for your support ;) >> >> I’ve same errors when i’m executing: :( >> >> sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img >> >> The error: >> >> Volatility Foundation Volatility Framework 2.3.1 >> ERROR : __main__ : You must specify something to do (try -h) >> >> Maybe the cause of this error can be that the new plugin “ethscan" isn't compatible with non instalable version of volatility 2.3.1, what do you think about? >> >> On the other hand, i found a brief tutorial about ethscan: >> >> https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/README.t… >> >> vol.py ethscan -f be2.vmem -R --dump-dir outputfiles -C out.pcap -P -S >> >> The execution of the vol.py command is different……. :( >> >> He does not the flag —-plugin= >> >> Thanks for all!! >> >> Ps: My apologies for my level of english >> >> >> El 13/11/2013, a las 16:43, Jamie Levy <jamie.levy(a)gmail.com> escribió: >> >>> Hi David, >>> >>> I think you might have also asked this on the channel. So yes, you should use the `--plugins=/path/to/folder/with/ethscan` option, obviously changing the path to a folder that has that plugin. If you were the person on the channel, the issue that you were having is because you must specify `--plugins` first, BEFORE any other options to vol.py: >>> >>> http://code.google.com/p/volatility/wiki/VolatilityUsage23#Specifying_Addit… >>> >>> Let me know if you have any other questions. >>> >>> All the best, >>> >>> -gleeda >>> >>> >>> >>> >>> On Tue, Nov 12, 2013 at 6:42 AM, David Martin <eterno.comandante(a)gmail.com> wrote: >>> Hello list, >>> >>> Please, I need some help about for add/use new plugins in volatility 2.3.1. >>> >>> Can I use the flag "--plugins=contrib/plugins"? o is there any method? >>> >>> The plugin that I want for add/use is: >>> >>> https://code.google.com/p/jamaal-re-tools/source/checkout >>> >>> Thanks for your support!! >>> >>> >>> >>> >>> >>> _______________________________________________ >>> Vol-users mailing list >>> Vol-users(a)volatilesystems.com >>> http://lists.volatilesystems.com/mailman/listinfo/vol-users >>> >>> >>> >>> >>> -- >>> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 >> >

11 years, 7 months

1
0
0 0

Re: [Vol-users] Help to add new plugin

by Jamie Levy

Try: sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 ethscan First: --plugins takes in either a directory or a zipfile, not a plugin Second: You didn't specify which plugin to run (ethscan) -----Original Message----- From: David <eterno.comandante(a)gmail.com> Date: Thu, 14 Nov 2013 10:41:47 To: Jamie Levy<jamie.levy(a)gmail.com> Cc: Volatility List<vol-users(a)volatilesystems.com> Subject: Re: [Vol-users] Help to add new plugin Sorry I had a typo i didn´t write --profile=Win7SP1x64 > sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img --profile=Win7SP1x64 I have the same error of ever :( > Volatility Foundation Volatility Framework 2.3.1 > ERROR : __main__ : You must specify something to do (try -h) Thanks!! El 14/11/2013, a las 09:36, David <eterno.comandante(a)gmail.com> escribió: > Hi @Jamie and list > > Thanks very much for your support ;) > > I’ve same errors when i’m executing: :( > > sudo python vol.py --plugins=../jamaal-re-tools-f427978461d4/volplugins/ethscan.py -f /mnt/hgfs/E/ENSE/F/M/Audits/7523/200309/memory.img > > The error: > > Volatility Foundation Volatility Framework 2.3.1 > ERROR : __main__ : You must specify something to do (try -h) > > Maybe the cause of this error can be that the new plugin “ethscan" isn't compatible with non instalable version of volatility 2.3.1, what do you think about? > > On the other hand, i found a brief tutorial about ethscan: > > https://code.google.com/p/jamaal-re-tools/source/browse/volplugins/README.t… > > vol.py ethscan -f be2.vmem -R --dump-dir outputfiles -C out.pcap -P -S > > The execution of the vol.py command is different……. :( > > He does not the flag —-plugin= > > Thanks for all!! > > Ps: My apologies for my level of english > > > El 13/11/2013, a las 16:43, Jamie Levy <jamie.levy(a)gmail.com> escribió: > >> Hi David, >> >> I think you might have also asked this on the channel. So yes, you should use the `--plugins=/path/to/folder/with/ethscan` option, obviously changing the path to a folder that has that plugin. If you were the person on the channel, the issue that you were having is because you must specify `--plugins` first, BEFORE any other options to vol.py: >> >> http://code.google.com/p/volatility/wiki/VolatilityUsage23#Specifying_Addit… >> >> Let me know if you have any other questions. >> >> All the best, >> >> -gleeda >> >> >> >> >> On Tue, Nov 12, 2013 at 6:42 AM, David Martin <eterno.comandante(a)gmail.com> wrote: >> Hello list, >> >> Please, I need some help about for add/use new plugins in volatility 2.3.1. >> >> Can I use the flag "--plugins=contrib/plugins"? o is there any method? >> >> The plugin that I want for add/use is: >> >> https://code.google.com/p/jamaal-re-tools/source/checkout >> >> Thanks for your support!! >> >> >> >> >> >> _______________________________________________ >> Vol-users mailing list >> Vol-users(a)volatilesystems.com >> http://lists.volatilesystems.com/mailman/listinfo/vol-users >> >> >> >> >> -- >> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 >

11 years, 7 months

1
0
0 0

Lookup Process Name by Memory Address on Windows XP

by Matthew Wong

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt

11 years, 7 months

4
4
0 0

Help to add new plugin

by David Martin

Hello list, Please, I need some help about for add/use new plugins in volatility 2.3.1. Can I use the flag "--plugins=contrib/plugins"? o is there any method? The plugin that I want for add/use is: https://code.google.com/p/jamaal-re-tools/source/checkout Thanks for your support!!

11 years, 7 months

2
1
0 0

problem using winpmem tool

by Nouman Zia

Hi, I am using winpmem 1.3.1 for imaging in volatility but whenever I tried to use any of feature of winpmem it gives error: "Cannot open SCM? Are you administrator" Where as I don't have any administrative passwords... So how can I solve this issue...???

11 years, 7 months

3
2
0 0

diagnose problematic ram dump?

by Dewhirst, Rob

I have a Win7SP1x64 image with the following issues: imageinfo never completes (this is as far as it gets) Determining profile based on KDBG search... Suggested Profile(s) : Win2008R2SP0x64, Win7SP1x64, Win7SP0x64, Win2008R2SP1x64 AS Layer1 : AMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/data/8564/8564.raw) PAE type : No PAE DTB : 0x187000L pslist shows no processes netscan shows no connections. I am using Volatility 2.3.1 on linux, but I have tried the standalone windows exe with the same results. Image was collected with winpmem 1.4.1, and I watched the capture. I did not see any errors and it seemed to take about the right amount of time. What would be my next steps to troubleshoot?

11 years, 7 months

5
6
0 0

Three 2014 Volatility & Memory Forensics trainings are now scheduled

by Andrew Case

As we previously sent to the list, the Volatility team will be holding training sessions in San Diego in January and London in June: http://volatility-labs.blogspot.com/2013/09/2014-malware-and-memory-forensi… We have now also finalized plans for a training in NYC in May: http://volatility-labs.blogspot.com/2013/10/2014-malware-and-memory-forensi… These will be the only public trainings through August of next year, and we have already received substantial interest in each one. If you plan to attend do not wait until the last minute to contact us as for our last several trainings we have had to turn away people once the classroom fills. If your company is interested in a private training or hosting a public training in exchange for a few free seats then please let us know ASAP as these opportunities for 2014 will likely be taken by other companies over the next month or two. Finally, the Volatility team would like to thank everyone who came out to OMFW and to those of you who attended our OSDFC talk and showed support for the project. Over the next couple weeks we will be sending out slides and updates from OMFW, and please reach out to us if you have questions for any of the speakers that you did not get to ask in person. Thanks, Andrew (@attrc)

11 years, 7 months

1
0
0 0

timeliner and 64-bit image?

by Thomas

Hi, currently I'm preparing a Volatility Workshop ... and writing the docs I did run several plugins. My test case contains a Win7SP1x64 image. Everything is fine, except the contrib/malware plugins (poisonivy, zeus) did complain about: This command does not support the profile Win7SP1x64 No I get this error message also for timeliner!? But timeliner did work correctly past weekend, using the _same_ Win7SPx64 image! Using a different image containing WinXP timeliner does work correctly. I'm using Revision 3532. What did happen with timeliner? Regards, Thomas

11 years, 7 months

2
3
0 0

Volatility 2.3 Released! (Official Mac OS X and Android Support)

by AAron Walters

https://code.google.com/p/volatility/ The Volatility Foundation is thrilled to announce the official release of Volatility 2.3! While the main goal of this release was Mac OS X (x86, x64) and Android Arm support, we also included a number of other exciting new capabilities! Highlights of this release include: Mac OS X: * New MachO address space for 32-bit and 64-bit Mac memory samples * Over 30+ plugins for Mac memory forensics Linux/Android: * New ARM address space to support memory dumps from Linux and Android devices on ARM hardware * Plugins to scan Linux process and kernel memory with yara signatures, dump LKMs to disk, and check TTY devices for rootkit hooks * Plugins to check the ARM system call and exception vector tables for hooks Windows: * New plugins: - Parse IE history/index.dat URLs - Recover shellbags data - Dump cached files (exe/pdf/doc/etc) - Extract the MBR and MFT records - Explore recently unloaded kernel modules - Dump SSL private and public keys/certs - Display details on process privileges - Detect poison ivy infections - Find and decrypt configurations in memory for poison ivy, zeus v1, zeus v2 and citadelscan 1.3.4.5 * Plugin Enhancements: - Apihooks detects duqu style instruction modifications - Crashinfo displays uptime, systemtime, and dump type - Psxview plugin adds two new sources of process listings from the GUI APIs - Screenshots plugin shows text for window titles - Svcscan automatically queries the cached registry for service dlls - Dlllist shows load count to distinguish between static and dynamic loaded dlls New Address Spaces: * VirtualBox ELF64 core dumps * VMware saved state (vmss) * VMware snapshot (vmsn) files * FDPro's non-standard HPAK format * New plugins: vboxinfo, vmwareinfo, hpakinfo, hpakextract We also wanted to take this opportunity to recognize those on the development team who's continued dedication to open source forensics and the Volatility community has made this release possible: Mike Auty, Andrew Case, Michael Hale Ligh, Jamie Levy, and AAron Walters. These people volunteer their time and skills to bring you the most advanced and innovative memory forensics framework in the world! If you appreciate the hard work they put into Volatility, I encourage you help defend the rights of open source developers and support developer endorsed events! Finally, shoutz to the Volatility Community for their continued support and feedback! In particular, the following members of the Volatility community made significant contributions to this release: - Cem Gurkok for his work on the privileges plugin for Windows - Nir Izraeli for his work on the VMware snapshot address space (see also the vmsnparser project) - @osxmem of the volafox project (Mac OS X & BSD Memory Analysis Toolkit) - @osxreverser of reverse.put.as for his help with OSX memory analysis - Carl Pulley for numerous bug reports, example patches, and plugin testing - Andreas Schuster for his work on poison ivy plugins for Windows - Joe Sylve for his work on the ARM address space and significant contributions to linux and mac capabilities - Philippe Teuwen for his work on the virtual box address space - Santiago Vicente for his work on the citadel plugins for Windows If you want to learn more about Volatility 2.3 or just hang out with the Volatility development team, I encourage you to register for the Open Memory Forensics Workshop 2013. Please register quickly, we will be ending registration by COB Friday, October 25 (Today). There have been a couple last minute cancellations, so you may still have a chance to reserve a seat!

11 years, 7 months

1
0
0 0

Re: [Vol-users] (win7x64) : creating images for volatility

by Boudewijn Ector

On 23-10-13 17:28, david nardoni wrote: > Also I would try netscan instead of connscan for win7. But it sounds like a problem with the > memory dump > Yeah I suppose the memorydump is *****ed... but wanted to make sure since I heard some rumours about having problems with *large* dumps on x64. And indeed I meant netscan, instead of connscan. My bad. @MHL: Thanks. indeed, old svn version... I'm using too many machines I guess. Just updated and reinstalled from trunk. On 23-10-13 17:37, Jamie Levy wrote: > You must have admin in order to acquire memory... How did you manage > to get a sample without having admin? If you have a virtualized > environment then you can acquire the memory from outside the machine > without having admin privileges on the acquired machine, however > (vmsn/vmss on esx for example). Actually, I do not know. I wasn't involved in the actual incident until some other guys decided to ask me. It's a bare metal box, so no hypervisor involved. Furthermore, they might have had admin but I'll probably create some new memory samples tomorrow and getting admin in a timely manner is quite hard. Currently the box is next to me so I can take some time to create a good sample. On 23-10-13 17:30, Andrew Case wrote: > Nice to hear from someone from our class =) Nice to see all three teachers reply on-list. Hope you enjoyed teaching the class as much as I did attending it. > > A few things about your post... > > 8GB on x64 is where several acquisition tools seem to break, so it is > may be that and your output seems to indicate so. Since the box is actually idling, I might remove a DIMM and thereby create a nice 4GB environment. The reason for keeping the 8gigs in is that it will improve my chances of having trace still in memory instead of having those swapped/overwritten. Is there a fast way to tell the image is bad? (yup I think my current one is bad, but I'm going to need to test again by tomorrow) And, is the slowness being indicative of having a bad image? > Also, you are using Volatility 2.2 which is quite old at this point. I > would recommend using the latest through SVN. Not only is there many > bugfixes, but also new plugins, such as iehist Yup. That's the plugin I was looking for. Guess I downloaded the release version of volatility on this box, instead of getting it from SVN. Fixed it, thanks! > Also, we have full support for networking information on Windows 7 > x64, you just have to use the netscan plugin and not the others > (sockets, sockscan, etc.). Indeed. > Do you have any other acquisition tools you can use or are your > machines virtualized? I can use whatever free tools I like, and am probably allowed to spend a moderate amount of money in order to buy stuff. Buying tools will take time though (boss has to acknowledge the order etc etc etc) so getting free stuff is preferred. The infected machines are not virtualised and the malware is probably virtualisation-aware, so that's not an option I'm afraid. Anybody got some more useful stuff? I used volatility quite a couple of times but never created my own images on hardware (used either somebody else's samples or VMs). Cheers, Boudewijn Ector

11 years, 7 months

2
2
0 0

(win7x64) : creating images for volatility

by Boudewijn Ector

Hi guys, Currently I've got a sample of an infected win7 machine with enough memory (8gb) which is not being used by anything except for 'the malware' (no running office etc) so quite a lot of stuff should not have been swapped out of memory yet. Strangely, I can't dump the process: ; vol.py -f dump.raw --profile=Win7SP1x64 procexedump -p 4932 --dump-dir results/4932.bin Volatile Systems Volatility Framework 2.2 Process(V) ImageBase Name Result ------------------ ------------------ -------------------- ------ Okay so it might be not in memory anymore... fine. So let's scan for network activity using connscan. This does not yield any results either.... just like svcscan. Also the image is very very slow... on a regular machine (core i5 2400, 20gb mem) running imageinfo on the 8gb images takes about 10 minutes. Also malfind mentions : WARNING : volatility.obj : NoneObject as string: Invalid Address 0x05140000, instantiating _MMADDRESS_NODE WARNING : volatility.obj : NoneObject as string: Invalid Address 0x05140000, instantiating _MMADDRESS_NODE WARNING : volatility.obj : NoneObject as string: Invalid Address 0x21A4C320A, instantiating _MMADDRESS_NODE WARNING : volatility.obj : NoneObject as string: Invalid Address 0x21A4C320A, instantiating _MMADDRESS_NODE Psxview says al processes are like this: 0x000000021a841060 <PROCESSNAME> 6640 False True False False False Isn't that just weird? (yes it's because psscan is the only module being able to retrieve data from memory... but isn't that strange) This makes me presume my memory images are broken. My collaegue probably (!) used winpmem -f for doing this. What's the best way to create a memory image on a windows7 x64 box without having admin? (these boxes are remotely managed and it takes a looooot of time to make sure an admin will do something). Or is this just perfectly normal behaviour and is win7x64 just being badly supported by volatility? (I know the networkbased plugins don't work but that's okay... it's being mentioned in the docs) Furthermore: during our recent volatility training (in amsterdam), we used a plugin for getting data from internet explorer history. I had a look online and didn't find it, is it non-public? Cheers, Boudewijn Ector

11 years, 7 months

4
3
0 0

How to create Linux Profile?

by chris-2012＠arcor.de

Dear all, I tried to create a Linux profile according to [1]. Which packages are needed for an Ubuntu profile? I downloaded linux-headers-2.6.32-41_2.6.32-41.91_all.deb, extracted the file on a CentOS machine and pointed the Makefile to the header's path. The error message was: /tmp/header/usr/src/linux-headers-2.6.32-41/lib/modules/2.6.32-41/build was not found. 1. Do I have to download any other packages? 2. Is it possible to compile module.c on another distribution or do I need a running Ubuntu 10? Thank you in advance! Chris [1] http://code.google.com/p/volatility/wiki/LinuxMemoryForensics

11 years, 8 months

2
2
0 0

New plugins: Filelist and Virustotal

by Sebastien Bourdon-Richard

Hi, Based on the work AAron and the Volatility team have done for the dumpfiles plugin (thanks for the plugin btw), I have wrote two new plugins for Volatility. I have coded those plugins to learn more about the new dumpfiles plugin. I'm sharing them hoping they will be useful for someone else. The first plugin is filelist. It is used to list files that can be extracted by the dumpfiles plugin. The second plugin is virustotal and it is used to query/submit cached memory files to virustotal. Both plugins can be downloaded here [1]. Here's some examples on how to use the filelist plugin. Memory sample [2] was used for the examples. List exe files in the memory dump: C:\Volatility>python vol.py -f Bob.vmem filelist -r \.exe Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------- 0x81dd28d0 548 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\smss.exe 0x822741c8 612 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x81d45b00 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x822ec7f8 688 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\services.exe 0x81e5c028 700 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe 0x8226ba70 852 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmacthlp.exe 0x81d476d8 880 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x81d476d8 880 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x822dfbd0 1460 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe 0x82113220 1628 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmtoolsd.exe 0x81d163f8 1836 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe 0x81cf83a0 2024 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\alg.exe 0x81e584c0 1756 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81e584c0 1756 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81ca9028 1108 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x81ca9028 1108 No DataSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x820cdbd8 1116 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareUser.exe 0x820a83a8 1132 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe 0x81cbdd18 244 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x81cbdd18 244 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x820c3298 440 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x820c3298 440 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x81dc2e90 888 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x81dc2e90 888 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x82077868 1752 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe 0x82077868 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe List all files opened by PID 644 (i.e: winlogon.exe with Zeus/Zbot injected): C:\Volatility>python vol.py -f Bob.vmem filelist -p 644 Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ------------------------------------------------------------------------------------- 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81ebe598 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\user.ds 0x822e3ea0 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\local.ds 0x81f14590 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls 0x81ebe028 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls 0x81e4f4b0 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\locale.nls 0x822a4210 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls 0x822da598 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe […] List DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem filelist -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------------------- 0x81c8c8e8 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp 0x8206f028 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp 0x81dfadf0 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php 0x81ec1960 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf 0x81ec8f90 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...Temporary Internet Files\Content.IE5\index.dat 0x820da3d8 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat 0x820da470 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...r\Local Settings\History\History.IE5\index.dat Here's some examples on how to use the virustotal plugin. Please note that Virustotal plugin does not submit any files to VT by default. To use this plugin, edit virustotal.py and enter your VT API Key. By default, the plugin operate in public mode (i.e: maximum 4 requests per minute to VT). However, if you have a private key, it's possible to adjust the delay between queries with the --delay option. Query Virustotal for the file sdra64.exe present in memory: C:\Volatility>python vol.py -f Bob.vmem virustotal -r sdra64\.exe Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe Cache file type: DataSectionObject PID: 644 MD5: b3e40cb29a3125ac862570ed5b5212a5 Detection ratio: 38/41 Analysis date: 2010-05-23 00:22:26 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Trojan.Generic.KD.387 20100522 CAT-QuickHeal Win32.Packed.Krap.ao.4 20100521 McAfee PWS-Zbot.gen.ak 20100523 TheHacker Trojan/Kryptik.cqz 20100522 VirusBuster Trojan.Kryptik.IBE 20100522 NOD32 a variant of Win32/Kryptik.CQZ 20100522 F-Prot W32/Agent.FG.gen!Eldorado 20100523 Symantec Packed.Generic.292 20100522 Norman W32/Zbot.PFX 20100522 TrendMicro-HouseCall TROJ_ZBOT.AZR 20100523 Avast Win32:Crypt-FWN 20100522 eSafe None 20100520 ClamAV Trojan.Zbot-8228 20100522 Kaspersky Packed.Win32.Krap.ao 20100522 BitDefender Trojan.Generic.KD.387 20100523 Comodo TrojWare.Win32.TrojanSpy.Zbot.Gen 20100522 F-Secure Trojan.Generic.KD.387 20100522 DrWeb Trojan.Winlock.1115 20100522 AntiVir TR/Agent.AO.177 20100521 TrendMicro TROJ_ZBOT.AZR 20100522 McAfee-GW-Edition PWS-Zbot.gen.ak 20100522 Sophos Mal/FakeAV-BW 20100522 eTrust-Vet Win32/FakeAV!generic 20100521 Authentium W32/Agent.FG.gen!Eldorado 20100522 Jiangmin Packed.Krap.cfls 20100522 Antiy-AVL Packed/Win32.Krap.gen 20100521 a-squared Packed.Win32.Krap!IK 20100510 Microsoft Trojan:Win32/Malagent 20100522 ViRobot None 20100522 Prevx Medium Risk Malware 20100523 GData Trojan.Generic.KD.387 20100522 AhnLab-V3 Win-Trojan/Burnix.Gen 20100522 VBA32 Trojan.Win32.Inject.anij 20100522 Sunbelt Trojan-Spy.Win32.Zbot.gen (v) 20100522 PCTools HeurEngine.MaliciousPacker 20100522 Rising Trojan.Win32.Generic.51FFF748 20100522 Ikarus Packed.Win32.Krap 20100522 Fortinet None 20100522 AVG Cryptic.BL 20100523 Panda Trj/Krap.Y 20100522 Avast5 Win32:Crypt-FWN 20100522 Query DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem virustotal -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp Cache file type: DataSectionObject PID: 1752 MD5: aeb2581f6c99b4434fb8ed96aeb3e43d Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:31 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp Cache file type: DataSectionObject PID: 1752 MD5: c6ea3ec108b4610831883617dc877f4b Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:05 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 201005 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf Cache file type: DataSectionObject PID: 1752 MD5: cd3c38c9c0e910bf1fe722871039cf3d Detection ratio: 0/42 Analysis date: 2010-04-04 18:36:07 ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 1b6e92d96236f8d2307412283c7666cb File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 7b00dbeb59f8fc8e70f291731bd36811 File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: b995dc0123737ae13a70f71c88657daf File not present on VirusTotal * Query all pdf.php files in memory (ignore case) and upload any file that is unknown to VirusTotal:* C:\Volatility>python vol.py -f Bob.vmem virustotal -r pdf.php -i --submit Volatility Foundation Volatility Framework 2.3 *********************************************************************** File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 20100512 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: SharedCacheMap PID: 1752 MD5: ef6f0c1e573d6fbfa9c5b0d77cfbe2cd File not present on VirusTotal. Uploading file... Scan request successfully queued, come back later for the report Requested item is still queued for analysis...waiting 60 seconds Requested item is still queued for analysis...waiting 60 seconds Detection ratio: 17/40 Analysis date: 2013-10-14 19:35:44 Antivirus Result Update ------------------------- ---------------------------------------- ------------ MicroWorld-eScan Exploit.PDF-Name.Gen 20131014 nProtect Exploit.PDF-Name.Gen 20131014 CAT-QuickHeal None 20131014 McAfee None 20131014 Malwarebytes None 20131014 K7AntiVirus None 20131014 K7GW None 20131014 TheHacker None 20131014 NANO-Antivirus Exploit.Script.Pdfka.lcgj 20131014 F-Prot None 20131014 Symantec Bloodhound.PDF.8 20131014 Norman Obfuscated.JS 20131014 ByteHero None 20130923 Avast JS:Pdfka-gen [Expl] 20131014 ClamAV Heuristics.PDF.ObfuscatedNameObject 20131013 Kaspersky None 20131014 BitDefender Exploit.PDF-Name.Gen 20131012 Agnitum None 20131014 ViRobot None 20131014 Emsisoft Exploit.PDF-Name.Gen (B) 20131014 Comodo None 20131014 DrWeb SCRIPT.Virus 20131014 AntiVir EXP/Pidief.OR 20131014 McAfee-GW-Edition None 20131014 Sophos Mal/PdfEx-C 20131014 Jiangmin None 20131014 Panda None 20131014 Antiy-AVL None 20131014 Kingsoft None 20130829 Microsoft Exploit:Win32/Pdfjsc.EF 20131014 SUPERAntiSpyware None 20131014 GData Exploit.PDF-Name.Gen 20131014 Commtouch PDF/Obfusc.G!Camelot 20131014 TotalDefense None 20131011 VBA32 None 20131014 PCTools HeurEngine.PDF 20131002 ESET-NOD32 None 20131014 Ikarus Exploit.JS.Pdfka 20131014 Fortinet None 20131014 Baidu-International None 20131014 Hope this help! Regards, Sebastien [1]: https://github.com/sebastienbr/Volatility/tree/master/plugins [2]: https://www.honeynet.org/challenges/2010_3_banking_troubles

11 years, 8 months

2
1
0 0

yarascan failing to find libyara, I think

by David Kovar

Greetings, Vol 2.3 built from svn. Yara built from yara-project. OS is OS X 10.8.5. I tore out all the old copies of volatility while trying to get this to work. praha:mem kovar$ vol.py -f xp-base-44f9a302.vmem --profile WinXPSP3x86 yarascan -Y 'foo' Volatility Foundation Volatility Framework 2.3 ERROR : volatility.plugins.malware.malfind: Please install Yara from code.google.com/p/yara-project praha:mem kovar$ yara -v yara 2.0 (rev:223) bash-3.2# ls -l /usr/local/lib/libyara* lrwxr-xr-x 1 root admin 15 Oct 12 12:36 /usr/local/lib/libyara.0.0.0.dylib -> libyara.0.dylib -rwxr-xr-x 1 root admin 113736 Oct 12 12:36 /usr/local/lib/libyara.0.dylib -rw-r--r-- 1 root admin 393560 Oct 12 12:36 /usr/local/lib/libyara.a lrwxr-xr-x 1 root admin 15 Oct 12 12:36 /usr/local/lib/libyara.dylib -> libyara.0.dylib -rwxr-xr-x 1 root admin 938 Oct 12 12:36 /usr/local/lib/libyara.la -David

11 years, 8 months

1
1
0 0

Re: [Vol-users] yarascan failing to find libyara, I think

by David Kovar

Greetings, I had the 1.6 version installed. I tore it out and tried to build 1.7 but that is failing: bash-3.2# python setup.py build running build running build_ext building 'yara' extension cc -fno-strict-aliasing -fno-common -dynamic -I/usr/local/include -I/usr/local/opt/sqlite/include -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -I/usr/local/include -I/usr/local/Cellar/python/2.7.3/Frameworks/Python.framework/Versions/2.7/include/python2.7 -c yara-python.c -o build/temp.macosx-10.8-x86_64-2.7/yara-python.o yara-python.c:259: error: expected specifier-qualifier-list before ‘YARA_CONTEXT’ yara-python.c:321: error: expected declaration specifiers or ‘...’ before ‘YARA_CONTEXT’ yara-python.c: In function ‘process_externals’: yara-python.c:338: warning: implicit declaration of function ‘yr_define_integer_variable’ yara-python.c:338: error: ‘context’ undeclared (first use in this function) yara-python.c:338: error: (Each undeclared identifier is reported only once yara-python.c:338: error: for each function it appears in.) yara-python.c:342: warning: implicit declaration of function ‘yr_define_boolean_variable’ yara-python.c:346: warning: implicit declaration of function ‘yr_define_string_variable’ yara-python.c: At top level: yara-python.c:358: error: expected declaration specifiers or ‘...’ before ‘YARA_CONTEXT’ yara-python.c: In function ‘Rules_new_from_file’: Shall see if I can figure that out and then come back to Volatility. -David On Oct 12, 2013, at 12:43 PM, Lorenzo Cantoni <lorenzo.cantoni86(a)gmail.com> wrote: > Did you installed also the python bindings? (yarapython) > > Il 12/ott/2013 19:37 "David Kovar" <dkovar(a)gmail.com> ha scritto: > Greetings, > > Vol 2.3 built from svn. Yara built from yara-project. OS is OS X 10.8.5. I tore out all the old copies of volatility while trying to get this to work. > > praha:mem kovar$ vol.py -f xp-base-44f9a302.vmem --profile WinXPSP3x86 yarascan -Y 'foo' > Volatility Foundation Volatility Framework 2.3 > ERROR : volatility.plugins.malware.malfind: Please install Yara from code.google.com/p/yara-project > > praha:mem kovar$ yara -v > yara 2.0 (rev:223) > > bash-3.2# ls -l /usr/local/lib/libyara* > lrwxr-xr-x 1 root admin 15 Oct 12 12:36 /usr/local/lib/libyara.0.0.0.dylib -> libyara.0.dylib > -rwxr-xr-x 1 root admin 113736 Oct 12 12:36 /usr/local/lib/libyara.0.dylib > -rw-r--r-- 1 root admin 393560 Oct 12 12:36 /usr/local/lib/libyara.a > lrwxr-xr-x 1 root admin 15 Oct 12 12:36 /usr/local/lib/libyara.dylib -> libyara.0.dylib > -rwxr-xr-x 1 root admin 938 Oct 12 12:36 /usr/local/lib/libyara.la > > -David > > > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

11 years, 8 months

1
0
0 0

How long should it take to run 'wndscan' on 32+G Win7 64bit memory dump?

by Todd A

Hi List, Running volatility-2.2.standalone.exe on Win7 Pro 64bit AMD with 32GB of RAM. I'm new to volatility and I'm attempting to use it to troubleshoot apps that don't play nice with the Windows clipboard. I'm using the steps here: http://www.infosecisland.com/blogview/22429-Detecting-Window-Stations-and-C… I changed my registry to force a complete memory dump by setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled to be 1. (http://support.microsoft.com/kb/969028) I used System Internal's NotMyFault tool with the /crash switch to create the dump. (https://code.google.com/p/volatility/wiki/CrashAddressSpace) The resulting c:\windows\memory.dmp file is about 34GB in size. When I launch volatility, this is as far as it gets: C:\Users\taa\Downloads>volatility-2.2.standalone.exe -f c:\windows\memory.dmp --profile=Win7SP1x64 wndscan Volatile Systems Volatility Framework 2.2 It has been showing this for close to 3.75 hours. Task Manager shows two instances of volatility-2.2.standalone.exe running, one at a constant 1,144K RAM usage, and the other instance with RAM usage constantly changing in the range of 58MB to 73MB, averaging 13% CPU utilization. To mean this indicates it is doing /something/ even if it is caught in an infinite loop. If it's reasonable for volatility to run this long and longer, I'll just be patient, though it would be helpful if someone could give me an idea of how long it might take. If this is taking too long, what can I do to troubleshoot what it's doing? Kind regards, Todd

11 years, 8 months

2
2
0 0

Aw: Re: [Vol-users] KVM and Memory Dump

by chris-2012＠arcor.de

Hi Guanglin, thank you for your reply! I'm absolutely newbie, so my questions are probably a bit tedious. > > Libvmi seems a bit complicated to install, at least compared to the > > vboxmanage debugvm command. Is libvmi required for KVM or is it possible > to > > use virsh dump? > > > You should use LibVMI just for "online live" forensics over a virtual > machine. > > If you merely need an offline memory dump of a KVM virtual machine, feel > free to use virsh dump without LibVMI. I'm not sure, if I understand the difference. When I run the victim in a VM, I can hit virsh dump in another host terminal window and get a snapshot of the VM at this point in time? When I tried this a little while ago with an Windows 7 x64 SP0 image, it didn't work. So I thought this method is not suitable... The image format respective profile was recognized with imageinfo correctly. The host is CentOS 6.4. With libvmi I would get continuous updates? Chris

11 years, 8 months

5
6
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-users