- Vol-users - volatilityfoundation.org

Failed to import errors on last few revisions

by Tom Yarrish

Hello, Over the last week or so, when I've done an svn update on the 2.1_alpha code, I've been receiving the following errors: Volatile Systems Volatility Framework 2.1_alpha *** Failed to import volatility.plugins.overlays.windows.win2k3_sp2_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.zeusscan1 (AttributeError: 'module' object has no attribute 'ImpScan') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.zeusscan2 (AttributeError: 'module' object has no attribute 'ApiHooks') *** Failed to import volatility.plugins.overlays.windows.vista_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp2_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.xp_sp3_x86 (AttributeError: 'module' object has no attribute 'nt_types') *** Failed to import volatility.plugins.evtlogs (AttributeError: 'module' object has no attribute 'LdrModules') *** Failed to import volatility.plugins.overlays.windows.vista_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp2_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp0_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp2_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.xp_sp2_x86 (AttributeError: 'module' object has no attribute 'nt_types') *** Failed to import volatility.plugins.timeliner (AttributeError: 'module' object has no attribute 'LdrModules') *** Failed to import volatility.plugins.overlays.windows.vista_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp0_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') (This is with revision 1558) This is just from doing an imageinfo. I was thinking since it includes plugins that some plugins need to be updated for 2.1, but I didn't want to make the assumption. It does finish the KDBG search and give me the correct profile, so it's parsing the dump. Just wasn't sure about the errors. Thanks, Tom

14 years, 2 months

3
4
0 0

V2.0 connscan

by Mike Lambert

I have found an interesting result and have a fair amount of data to share. Bottom line is that connscan may have missed (and miss reported) some connections (see memory image). 2 IPs are missing and note the ports recorded by cports and those reported by V2.0 connscan. Check the attached xls search hits, where did port 1088 and 1064 come from? I can provide a copy of the memory image! Imager is win32dd.exe. Here is the IP connection record I have from cports: Date Time Log action PID Program Name Proto Source IP Destination IP 3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1063 212.117.175.34:80 3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1065 98.142.243.60:80 3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1066 98.142.243.60:80 3/12/2012 3:53:11 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1065 98.142.243.60:80 3/12/2012 3:53:11 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1066 98.142.243.60:80 3/12/2012 3:53:45 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1078 92.123.68.97:80 3/12/2012 3:54:06 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1080 98.142.243.60:80 3/12/2012 3:54:06 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1078 92.123.68.97:80 3/12/2012 3:54:27 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1080 98.142.243.60:80 3/12/2012 3:54:30 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1087 98.142.243.60:80 3/12/2012 3:54:31 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1063 212.117.175.34:80 3/12/2012 3:54:31 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1087 98.142.243.60:80 Here is the result of V2.0 connscan: Scan for connection objects (connscan): Offset Local Address Remote Address Pid ---------- ------------------------- ------------------------- ------ 0x041484c0 192.168.1.44:1088 98.142.243.60:80 1344 0x04193278 192.168.1.44:1093 65.54.51.29:443 3756 0x041cdc40 192.168.1.44:1064 98.142.243.60:80 1344 Attached is search results of the memory image, with memory offsets. (A few are dups and that may be the Win32dd imager) Where did ports 1088 and 1064 come from? If anyone wants a copy of the memory image, it is 115 MB Mike

14 years, 2 months

2
1
0 0

: v1.3 plugin installation

by Mike Lambert

When clicking on the list of Volatility plugins, I go to http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins >From the web page "Here is a list of the published plugins for the Volatility 1.3 framework" I do not see any "installation instructions" Do these plugins just get copied to C:\Python27\Volatility-1.3_Beta\memory_plugins ? Also, is there a like page for v2.0 ? >From http://code.google.com/p/volatility/wiki/FAQ#Where_do_I_find_the_"malware"_plugins there is a link to http://malwarecookbook.googlecode.com/svn/trunk/malware.py what Volatility version is the plugin for? I do not see Volatility version number in .py files so I get a little confused which is for which. Will plugins have "for Volaitility vX" in the future? Maybe I'm just not getting it. Sorry, Mike

14 years, 2 months

1
1
0 0

Fwd: Re: [Vol-users] BSOD while collecting a memory image

by George M. Garner J.r (online)

Meant to send this to the list not just the OP. -------- Original Message -------- Subject: Re: [Vol-users] BSOD while collecting a memory image Date: Sun, 11 Mar 2012 11:07:54 -0400 From: George M. Garner Jr. <ggarner_online(a)gmgsystemsinc.com> To: Mike Lambert <dragonforen(a)hotmail.com> Mike, > Is there malware that stops all imaging programs.. < Don't know about ALL imaging programs. There is anecdotal evidence of malware that stops some imaging programs and then allows others to run. Smart malware doesn't stop anything from running. Everything appears to be normal. Welcome to the matrix. Malware has for a long time sought to identify "white hat" software. Until recently this has been almost exclusively based on the file names of common anti-rootkit and IR packages. You could effectively defeat the anti-forensic techniques simply by renaming your tools. More recently, however, rootkits have begun to use other information to identify IR tools, in particular, the certificate info for signed PE executables. This is much more problematic. Particularly with the widespread adoption of 64-bit Windows, all device drivers must be signed and the signature can be used to identify your tools in an unambiguous way. There is a paper that will be published in the near future on developing a blackhat scanner. If you investigate sophisticated malware you should be thinking about getting your own code signing certificate(s). I believe that Sinowal was/is a "public" rootkit that attempts to remove itself from memory during hibernation. Whether a rootkit successfully removes all traces of itself from a hibernation file is another matter. Regards, g.

14 years, 2 months

1
0
0 0

BSOD while collecting a memory image

by Mike Lambert

I was testing different memory imaging programs on a 64 bit Windows 7 with 8 GB of memory and found that I could (not on purpose) BSOD the system. That put a dent in determining which memory imaging products are compatible with Volatility. Then I wondered if the "full memory dump on blue screen would be compatible". I'm looking into that now. A couple of problems are 1. "Full memory" dump is not available on the machines I'm working on so I don't know if I can just set it and go, or, does the system have to be booted with that option set. 2. Is the "full memory dump" comaptible with Volatility? 3. Keyboard generated crash dump is an option that has to be set and the system rebooted so that wouldn't work as a backup plan. My ultimate backup plan is to hibernate and convert the hiberfil.sys. That works so I'm not stuck with nothing. Question: Has someone gotten a full memory dump on BSOD and successfully processed it with Volatility? Question: Has anyone else thought about how to deal with BSOD and analysis? If it is not something that the list is interested in, we could take this offline. Have a good day everyone! Mike Lambert

14 years, 2 months

3
4
0 0

Volatility and Windows 7 images

by Tom Yarrish

Hey all, So we're moving to Windows 7 (64-bit) in our environment, and our current method of getting memory images off of machines has changed. So we're using EnCase Enterprise to grab memory dumps. Then what I've been doing is using FTK Imager to convert that to a DD image, and we run it through our regular tool. I run the same DD image through Volatility. I'm running Volatility on OS X Lion. Recently, I've noticed when I'm just doing an imageinfo with Volatility (both 2.0 and 2.1_alpha), I'm getting the following: Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : No suggestion (Instantiated with no profile) AS Layer1 : FileAddressSpace (memory.bin) PAE type : No PAE So my first thought was is was an issue with converting an E01 to a DD image. So I ran a test on a standard Windows 7 build in our organization. 1) Do a memory collection with EnCase, convert to DD with FTK Imager 2) Do a memory collection with FDPro 3) Do a memory collection with DumpIt Run the imageinfo command in both Volatility 2.0 and the 2.1_alpha code, and the results were the same with one exception. With the 2.0 code, and the DumpIt memory dump, I got the following: Volatile Systems Volatility Framework 2.0 Determining profile based on KDBG search... Suggested Profile(s) : Win7SP0x64 (Instantiated with no profile) AS Layer1 : FileAddressSpace (memory.raw) PAE type : No PAE But if I try to run another command with --profile=Win7SP0x64 I get: Volatile Systems Volatility Framework 2.0 ERROR : volatility.addrspace: Invalid profile Win7SP0x64 selected I'm just wondering if there's something funky with my Volatility installation, or if there could be something I need to check in our 7 build that could be causing this. Thanks ahead of time, Tom

14 years, 2 months

6
12
0 0

Re: [Vol-users] Volatility and Windows 7 images

by George M. Garner J.r (online)

Tom, > If you have anything I'd love to see it. Unfortunately nothing for public distribution. We provide our customers with a test framework which is intended to help validate our tools for the production of evidence suitable for admission in a court of law. A lot of work remains to be done. As you know volatile evidence collection tools cannot be validated in the same manner as traditional computer forensic tools which are designed for the acquisition of non-volatile storage media. There is no "image" that you can acquire and then reproduce. Running computer systems are often modeled as a continuous time stochastic process. By its nature a continuous time stochastic process cannot be measured in its entirety. It can only be sampled. Nevertheless, while they cannot be measured in their entirety, running computer systems do possess two attributes which may make it possible to validate, or rather invalidate, memory acquisition tools. The first attribute is that a running computer system is a STRUCTURED stochastic process. It is not entirely random and could not run if it were. The operating system, processor and other hardware define certain structural elements the presence of which may be inferred merely by the fact that the system is running. These structural elements CAN be measured and if they are not found in precisely the right location then your memory "dump" is crap. The second attribute derives from the fact that Microsoft Windows (and probably most other general purpose operating systems) provide an API which permits the programmer/user to define a discrete time stochastic process within the context of the larger continuous time stochastic process. By this I mean that you can load and lock a block of data with a known hash value into memory at a fixed location. You can then acquire the memory "dump" and attempt to recover the data block from the memory dump. If the number of samples is sufficiently large and the location of the samples is representative with respect to the location (below 4 GiB, above 4 GiB, "unmanaged" memory) and architecture (Intel, AMD, NUMA, non-NUMA) and amount of memory (< 4 GiB, > 4 GiB, > 16 GiB***) then it should be possible to make an inference as to the reliability of acquisition of memory as a whole based upon the reliability of acquisition of the samples. In any event, being able to exclude particularly unreliable memory acquisition tools would be a step forward, even if it falls short of validating the tools that remain for LE evidentiary purposes. I though that Volatility might be able to play a useful role in developing a public test framework if it were reworked to identify the present or missing structural elements (e.g. the missing page tables) in a documentable way. I asked Aaron about it last year but never got any response. Regards, gmg.

14 years, 2 months

2
1
0 0

Volatility install on OS X Lion

by Tom Yarrish

Hey all, So I went through the install docs for Linux on the wiki to install Volatility on my MacBook Pro running OS X Lion. I'm testing it using the samples from the Malware Cookbook (stuxnet.vmem in this case), and just doing: python ~/volatility-read-only/vol.py -f stuxnet.vmem imageinfo I'm getting the following output: Volatile Systems Volatility Framework 2.1_alpha Determining profile based on KDBG search... Traceback (most recent call last): File "/Users/e18529/volatility-read-only/vol.py", line 135, in <module> main() File "/Users/e18529/volatility-read-only/vol.py", line 126, in main command.execute() File "/Users/e18529/volatility-read-only/volatility/commands.py", line 101, in execute func(outfd, data) File "/Users/e18529/volatility-read-only/volatility/plugins/imageinfo.py", line 37, in render_text for k, v in data: File "/Users/e18529/volatility-read-only/volatility/plugins/imageinfo.py", line 47, in calculate suglist = [ s for s, _, _ in kdbg.KDBGScan.calculate(self)] File "/Users/e18529/volatility-read-only/volatility/plugins/kdbgscan.py", line 95, in calculate buf = addrspace.BufferAddressSpace(self._config) File "/Users/e18529/volatility-read-only/volatility/addrspace.py", line 161, in __init__ BaseAddressSpace.__init__(self, None, config, **kwargs) File "/Users/e18529/volatility-read-only/volatility/addrspace.py", line 68, in __init__ self.profile = self._set_profile(config.PROFILE) File "/Users/e18529/volatility-read-only/volatility/addrspace.py", line 90, in _set_profile ret = registry.PROFILES[profile_name]() File "/Users/e18529/volatility-read-only/volatility/obj.py", line 879, in __init__ self.reset() File "/Users/e18529/volatility-read-only/volatility/obj.py", line 906, in reset self.load_modifications() File "/Users/e18529/volatility-read-only/volatility/obj.py", line 960, in load_modifications mod.modification(self) File "/Users/e18529/volatility-read-only/volatility/plugins/overlays/windows/ssdt_vtypes.py", line 57, in modification profile.additional['syscalls'] = module.syscalls AttributeError: 'NoneType' object has no attribute 'syscalls' So I'm guessing I still don't have something configured correctly. Thanks ahead of time, Tom

14 years, 2 months

5
5
0 0

Re: [Vol-users] Windows kernel memory.

by carl galton

Thank you for your answers. > There is no such thing as "the address spaces of all processes." What I meant to say was that moddump plugin uses find_space function to find a process whose address space maps the searched driver. def find_space(self, addr_space, procs, mod_base): """Search for an address space (usually looking for a GUI process)""" if addr_space.is_valid_address(mod_base): return addr_space for proc in procs: ps_ad = proc.get_process_address_space() if ps_ad != None: if ps_ad.is_valid_address(mod_base): return ps_ad return None

14 years, 2 months

1
0
0 0

Windows kernel memory.

by carl galton

Hello, I am doing some research on Windows kernel, using volatility. I need to get the mapping from virtual addresses to physical ones for kernel memory. As far as I know, every process maps kernel virtual addresses (addresses upper than 0x7fffffff in 32bit Windows versions with 3GB split disabled) to physical ones in the same way. In other words, the address spaces relative to every process are equals for kernel virtual addresses. Is this always true? I noticed that some plugins (e.g. kdbgscan) use the address space of the process "Idle", others use the address spaces of all processes (e.g. modscan). Which is the right way to proccede to develop a plugin to get the full virtual to physicall mapping for kernel addresses? Thank you.

14 years, 2 months

3
2
0 0

Userhandles

by Sebastien Bourdon-Richard

Hi All, I was looking at the Stuxnet footprint blog post (who is excellent btw) and I was interested by the userhandles plugin. ./vol.py userhandles -t TYPE_WINDOW http://mnin.blogspot.com/2011/06/examining-stuxnets-footprint-in-memory.html I can't find this plugin for volatility... Does it comes with another plugin? Where can I download it? Thanks in advance, Sebastien

14 years, 2 months

4
7
0 0

strings for new SpyEye

by Mike Lambert

Does anyone have any strings unique for the new SpyEye mentioned in this article? http://redtape.msnbc.msn.com/_news/2012/01/06/9986119-new-virus-raids-your-… If you have a memory image with this trojan, could you share it with me? Mike Lambert michael-lambert.us

14 years, 2 months

2
2
0 0

Re: [Vol-users] stings input file format question

by Jamie Levy

Glad I could help! Yep, I've seen this before many times ;-) All the best, -gleeda -----Original Message----- From: Mike Lambert <dragonforen(a)hotmail.com> Date: Mon, 27 Feb 2012 17:02:15 To: <jamie.levy(a)gmail.com> Subject: RE: [Vol-users] stings input file format question My thanks! Well you called that one! I was using Encase's "Export" to output a text file of the offsets of the hits from the search result tab. Encase outputs unicode text. I just need to put a new step in the process, convert it to ANSI before running it with the strings command. And it does have a funky befinning of file marker.... You must have seen this before? Best, Mike > Date: Mon, 27 Feb 2012 16:39:08 -0500 > Subject: Re: [Vol-users] stings input file format question > From: jamie.levy(a)gmail.com > To: dragonforen(a)hotmail.com > > hrmmmmm I don't see anything obviously wrong here... But since you > said these offsets are from EnCase, how were they obtained? By > EnScript to a file, copy+paste from the console or some other method? > I'm just curious if the offsets were exported in ASCII or EnCase's > default UTF-16. Also sometimes when exporting in unicode, there's a > funky corrupt BOM that EnCase uses that might be messing things up... > I'm just trying to think of things that might have gone wrong here. > > Maybe you could try copy and pasting a few of these "Ypycub" entries > into a new text file and running the strings plugin again to see. > > All the best, > > -gleeda > > > On Mon, Feb 27, 2012 at 4:06 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote: > > I am mystified why I see the following: in one case I get output from > > strings and the other I get an input file format error. I have tried this > > with 1.3 and 2.0 and get the same result. It takes 1.3 a looonnngg time to > > return the error, 2.0 returs the error quickly. > > > > I thought the reason may be length, so I broke up the Ypycub offsets into > > increasingly smaller input files; no success was achived with the smaller > > input files. > > I don't see a format difference in these 2 files. > > > > The offsets come from an Encase search of 120225b.mem. It is a 458MB > > WinXPSP3x86 image converted from hiberfil.sys. > > > > > > Vol 1.3 example: The same result is seen with Vol 2.0 > > > > The input file is: > > > > 357229672:Glows > > 280642408:Glows > > 257105340:Glows > > 113457472:Glows > > 357230696:Glows > > > > > > C:\Python27\Volatility-1.3_Beta>python volatility strings -f > > e:\tests\120225b\IRinfo\120225b.mem -s 120225b_Glows_offsets.txt > > > > 357229672 [kernel:df864468 ] Glows > > 280642408 [1456:45b8368 ] Glows > > 257105340 [kernel:e1ec1dbc ] Glows > > 113457472 [1456:2ac0940 ] Glows > > 357230696 [kernel:df864868 ] Glows > > > > ----------------------cut-here------------------------- > > The input file is: > > > > 7744388:Ypycub > > 10830274:Ypycub > > 70385414:Ypycub > > 70918297:Ypycub > > 70918649:Ypycub > > 73375514:Ypycub > > 91390974:Ypycub > > 104879126:Ypycub > > 104879154:Ypycub > > 132968006:Ypycub > > 215776800:Ypycub > > 232868024:Ypycub > > 232869190:Ypycub > > 237434963:Ypycub > > 237434991:Ypycub > > 256642118:Ypycub > > 285030170:Ypycub > > 310449659:Ypycub > > 310449687:Ypycub > > 314178656:Ypycub > > 325974496:Ypycub > > 327972307:Ypycub > > 327972335:Ypycub > > 338814062:Ypycub > > 338814854:Ypycub > > 339229856:Ypycub > > 339763304:Ypycub > > 339763544:Ypycub > > 339893168:Ypycub > > 340101984:Ypycub > > 343215259:Ypycub > > 343215287:Ypycub > > 357229759:Ypycub > > 361836122:Ypycub > > 367889650:Ypycub > > 455348611:Ypycub > > 455348639:Ypycub > > > > > > C:\Python27\Volatility-1.3_Beta>python volatility strings -f > > e:\tests\120225b\IRinfo\120225b.mem -s 120225b_Ypycub_offsets.txt > > > > Usage: strings [options] (see --help) > > volatility: error: String file format invalid. > > > > > > Thanks for any assistance. > > > > Mike > > > > > > > > > > > > _______________________________________________ > > Vol-users mailing list > > Vol-users(a)volatilesystems.com > > http://lists.volatilesystems.com/mailman/listinfo/vol-users > > > > > > -- > PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

14 years, 2 months

2
3
0 0

Re: [Vol-users] stings input file format question

by Jamie Levy

Sorry I meant for this to go to the list also: On Mon, Feb 27, 2012 at 4:39 PM, Jamie Levy <jamie.levy(a)gmail.com> wrote: > hrmmmmm I don't see anything obviously wrong here... But since you > said these offsets are from EnCase, how were they obtained? By > EnScript to a file, copy+paste from the console or some other method? > I'm just curious if the offsets were exported in ASCII or EnCase's > default UTF-16. Also sometimes when exporting in unicode, there's a > funky corrupt BOM that EnCase uses that might be messing things up... > I'm just trying to think of things that might have gone wrong here. > > Maybe you could try copy and pasting a few of these "Ypycub" entries > into a new text file and running the strings plugin again to see. > > All the best, > > -gleeda > > > On Mon, Feb 27, 2012 at 4:06 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote: >> I am mystified why I see the following: in one case I get output from >> strings and the other I get an input file format error. I have tried this >> with 1.3 and 2.0 and get the same result. It takes 1.3 a looonnngg time to >> return the error, 2.0 returs the error quickly. >> >> I thought the reason may be length, so I broke up the Ypycub offsets into >> increasingly smaller input files; no success was achived with the smaller >> input files. >> I don't see a format difference in these 2 files. >> >> The offsets come from an Encase search of 120225b.mem. It is a 458MB >> WinXPSP3x86 image converted from hiberfil.sys. >> >> >> Vol 1.3 example: The same result is seen with Vol 2.0 >> >> The input file is: >> >> 357229672:Glows >> 280642408:Glows >> 257105340:Glows >> 113457472:Glows >> 357230696:Glows >> >> >> C:\Python27\Volatility-1.3_Beta>python volatility strings -f >> e:\tests\120225b\IRinfo\120225b.mem -s 120225b_Glows_offsets.txt >> >> 357229672 [kernel:df864468 ] Glows >> 280642408 [1456:45b8368 ] Glows >> 257105340 [kernel:e1ec1dbc ] Glows >> 113457472 [1456:2ac0940 ] Glows >> 357230696 [kernel:df864868 ] Glows >> >> ----------------------cut-here------------------------- >> The input file is: >> >> 7744388:Ypycub >> 10830274:Ypycub >> 70385414:Ypycub >> 70918297:Ypycub >> 70918649:Ypycub >> 73375514:Ypycub >> 91390974:Ypycub >> 104879126:Ypycub >> 104879154:Ypycub >> 132968006:Ypycub >> 215776800:Ypycub >> 232868024:Ypycub >> 232869190:Ypycub >> 237434963:Ypycub >> 237434991:Ypycub >> 256642118:Ypycub >> 285030170:Ypycub >> 310449659:Ypycub >> 310449687:Ypycub >> 314178656:Ypycub >> 325974496:Ypycub >> 327972307:Ypycub >> 327972335:Ypycub >> 338814062:Ypycub >> 338814854:Ypycub >> 339229856:Ypycub >> 339763304:Ypycub >> 339763544:Ypycub >> 339893168:Ypycub >> 340101984:Ypycub >> 343215259:Ypycub >> 343215287:Ypycub >> 357229759:Ypycub >> 361836122:Ypycub >> 367889650:Ypycub >> 455348611:Ypycub >> 455348639:Ypycub >> >> >> C:\Python27\Volatility-1.3_Beta>python volatility strings -f >> e:\tests\120225b\IRinfo\120225b.mem -s 120225b_Ypycub_offsets.txt >> >> Usage: strings [options] (see --help) >> volatility: error: String file format invalid. >> >> >> Thanks for any assistance. >> >> Mike >> >> >> >> >> >> _______________________________________________ >> Vol-users mailing list >> Vol-users(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >> > > > > -- > PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 -- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

14 years, 2 months

1
0
0 0

VM image of memory- This is not a VMEM file

by Lou LaRocca

When imaging memory on a live VM system to do analysis for malware Volatililty does not recognize it (see below). Is there anyone on this mailing list that has the knowledge on how I can remedy this without shutting the system down and grabbing the VMEM file? Is it possible to substitute a valid DTB from another image into the memdump of a live VM machine with a Hex editor? And if it can be done does anyone know the addresses of that space to take out and substitute? I hope that made sense...... If you look at a normal image of memory in a hex editor you can clearly see the difference between that and a VM dump from a live system, there seems to be some extra padded stuff right up front. Volatile Systems Volatility Framework 2.0 No suitable address space mapping found Tried to open image as: WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace32: No base Address Space JKIA32PagedMemory: No base Address Space JKIA32PagedMemoryPae: No base Address Space IA32PagedMemoryPae: Module disabled IA32PagedMemory: Module disabled WindowsHiberFileSpace32: No xpress signature fou WindowsCrashDumpSpace32: Header signature invali JKIA32PagedMemory: No valid DTB found JKIA32PagedMemoryPae: No valid DTB found IA32PagedMemoryPae: Module disabled IA32PagedMemory: Module disabled FileAddressSpace: Must be first Address Space Thanks Lou

14 years, 3 months

6
7
0 0

64 bit branch

by Glenn P. Edwards Jr.

I recall there being an experimental 64 bit branch up at the Google code site (not the lin64 one)... But when I just went to grab it , it appears to be gone. Is it somewhere else? :: Sent from my mobile phone; please excuse any typos ::

14 years, 3 months

2
1
0 0

Get virtual address corresponding to a dll

by Eknath Venkataramani

I have a foo.dll loaded in memory. Using `dlllist` I can see that the physical address is 0x252438. How do I get the virtual address? -- Eknath Venkataramani

14 years, 3 months

3
2
0 0

what is at that address

by Mike Houston

I have a text string that I found in memory and I would like to find out what is using/mapped to that address. (a process, a dll, a buffer, unallocated, etc.) How do I do that? I'm exploring the docs to see how close I can get; for example dumping what I can with memmap, and then searching for my physical offset. (but that only gets me processes) Any suggestions appreciated. Mike Lambert dragonforen(a)hotmail.com

14 years, 3 months

5
9
0 0

FW: [Vol-users] what is at that address

by Mike Lambert

Thanks Mike, I got the plugin and put it in the plugin directory. I looked at the plugin help and did not see how to specify the address to translate. I tried this without a switch: C:\Python27\volatility-2.0>python vol.py pas2kas -f \mem\120129\120129c.w32 --profile=WinXPSP3x86 0x19248000 Volatile Systems Volatility Framework 2.0 YARA is not installed, see http://code.google.com/p/yara-project/ distorm3 is not installed, see http://code.google.com/p/distorm/ Phys AS KAS C:\Python27\volatility-2.0> It seems I am not specifying the address to translate properly. Perhaps you can correct my commandline. Thanks, Mike PS. Yara will not install because it does not see a key for python27 in the registry. Do you know what key I should put in the registry so Yara will install? > From: scudette(a)gmail.com > Date: Fri, 3 Feb 2012 23:34:43 -0800 > Subject: Re: [Vol-users] what is at that address > To: dragonforen(a)hotmail.com > CC: vol-users(a)volatilityfoundation.org > > Mike, > You could also use the pas2kas module: > > http://code.google.com/p/volatility/source/browse/branches/scudette/volatil… > > Michael. > > On 3 February 2012 15:00, Mike Houston <dragonforen(a)hotmail.com> wrote: > > I have a text string that I found in memory and I would like to find out > > what is using/mapped to that address. (a process, a dll, a buffer, > > unallocated, etc.) > > > > How do I do that? I'm exploring the docs to see how close I can get; for > > example dumping what I can with memmap, and then searching for my physical > > offset. (but that only gets me processes) > > > > Any suggestions appreciated. > > > > Mike Lambert > > dragonforen(a)hotmail.com > > > > > > > > > > _______________________________________________ > > Vol-users mailing list > > Vol-users(a)volatilityfoundation.org > > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > >

14 years, 3 months

1
0
0 0

Traceback errors when using yara

by Andre' M. DiMino

Greetings, I'm seeing the following errors when attempting to run volatility with 'malfind' and referencing yara. This used to work fine on yara 1.4, but now fails on 1.6. I'm wondering what might have happened and how to resolve it. ~/vol.py -f purple.vmem --profile=WinXPSP3x86 malfind -D /home/apollo/workspace/dump_dir/ --yara-rules="http://" -p 1004 Volatile Systems Volatility Framework 2.1_alpha Name Pid Start End Tag Hits Protect Traceback (most recent call last): File "/home/apollo/vol.py", line 135, in <module> main() File "/home/apollo/vol.py", line 126, in main command.execute() File "/home/sportivo/tools/Volatility/volatility/commands.py", line 101, in execute func(outfd, data) File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py", line 1042, in render_text for (name,pid,start,end,tag,prx,fname,hits,chunk) in data: File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py", line 992, in calculate for ps_ad, start, end, tag, prx, data in self.get_vads(proc): File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py", line 923, in get_vads yield (ps_ad, start, end, vad.Tag, vad.Flags.Protection >> 24, data) File "/home/sportivo/tools/Volatility/volatility/obj.py", line 777, in __getattr__ return self.m(attr) File "/home/sportivo/tools/Volatility/volatility/obj.py", line 762, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct VadRoot has no member Flags Any thoughts or ideas are welcome. Thanks! Andre' -- Andre' M. DiMino DeepEnd REsearch http://deependresearch.org http://sempersecurus.org "Make sure that nobody pays back wrong for wrong, but always try to be kind to each other and to everyone else" - 1 Thess 5:15 (NIV)

14 years, 3 months

2
2
0 0

Volatility errors after update?

by Andre' M. DiMino

I just did an svn update to version 1327 and I'm now noticing the following errors upon execution of any volatility command. For example: ~/tools/Volatility/vol.py -f XP_SP3.vmem imageinfo Volatile Systems Volatility Framework 2.1_alpha *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with WinXPSP2x86) : snip : ~/tools/Volatility/vol.py -f XP_SP3.vmem --profile=WinXPSP3x86 connscan Volatile Systems Volatility Framework 2.1_alpha *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') Offset(P) Local Address Remote Address Pid ---------- ------------------------- ------------------------- ------ 0x0219fa40 0.0.0.0:19272 0.0.0.0:55542 2147487916 ~/tools/Volatility/vol.py -f XP_SP3.vmem --profile=WinXPSP3x86 modules Volatile Systems Volatility Framework 2.1_alpha *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') *** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86 (AttributeError: 'module' object has no attribute 'ntkrnlmp_types') Offset(V) File Base Size Name 0x823fc3a0 \WINDOWS\system32\ntkrnlpa.exe 0x00804d7000 0x1f8580 ntoskrnl.exe 0x823fc338 \WINDOWS\system32\hal.dll 0x00806d0000 0x020300 hal.dll : snip : Everything seems to complete OK so far, but I'm wondering what might have caused these new error messages. Thanks! Andre' -- Andre' M. DiMino DeepEnd REsearch http://deependresearch.org http://sempersecurus.org "Make sure that nobody pays back wrong for wrong, but always try to be kind to each other and to everyone else" - 1 Thess 5:15 (NIV)

14 years, 3 months

3
3
0 0

Volatility-Linux TypeError

by Patrick Burkard

Hello, in the last view weeks i've tried to analyze Linux memorydumps with the volatility-linux Version (Revision 1313 from svn). My goal is to show that it is possible to discover hidden processes, kernelmodules etc. (for example from a rootkit) from a memory dump. By comparing the output from the memorydump analysis with the native execution of the system commands. I created a profile for the current stable Debian version. Trying to use this profile leads to the following TypeError: python volatility.py --profile=LinuxDebian26325 -f ~/Desktop/LF32.ram linux_task_list_ps Volatile Systems Volatility Framework 1.4_rc1 Name Pid Uid Traceback (most recent call last): File "volatility.py", line 129, in <module> main() File "volatility.py", line 120, in main command.execute() File "/home/dark-eye/Sources/volatility_linux/volatility/commands.py", line 101, in execute func(outfd, data) File "/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_task_list_ps.py", line 59, in render_text for task in data: File "/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_task_list_ps.py", line 50, in calculate for task in linux_common.walk_list_head("task_struct", "tasks", init_task.tasks, self.addr_space): File "/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_common.py", line 110, in walk_list_head yield obj.Object(struct_name, offset = list_ptr - offset, vm = addr_space) TypeError: unsupported operand type(s) for -: 'instancemethod' and 'int' I would really appreciate to debug or help to debug this issue. Sadly I can't find a way to evaluate the correctness of the kernel-profile. Is this a known problem from volatility-linux or could it be the result of a failure i've made while creating the debian profile? Thanks for every hint! Greetings Patrick

14 years, 3 months

5
11
0 0

Vote Volatility: 2011 Toolsmith Tool of the Year

by AAron Walters

In case you may have missed it, Volatility 2.0 has been nominated for the ISSA Journal's Toolsmith Tool of the Year. If you believe in open source forensics tools and want to show your support for the Volatility team, please take a few moments to cast your vote! Feel free to tell all your friends and family to vote as well! You have until January 31 to vote from all your machines! http://holisticinfosec.blogspot.com/2011/12/choose-2011-toolsmith-tool-of-y… X September - Volatility for memory analysis If you need extra motivation, you may want to check out the 64-bit Beta support recently merged into trunk! Bug reports welcome! Enjoy! Thanks, The Volatility Project (TVP)

14 years, 3 months

1
0
0 0

api hooking

by malware monna

Hi All, i'm new to Volatility, i was trying to analyze a spyeye sample, and while running apihooks i got the below output, it looks like there is inline api hook and i see jump into this 0xba.....location.... i would like to know the DLL that is associated with a JMP, in this case it shows unknown............how can i determine the dll? and how can dump the dll from the memory?.....any information would be helpful, sorry this could be a stupid question. VMwareUser.exe[636] inline wininet.dll!InternetReadFile[0x7806abb4] 0x7806abb4 JMP 0xbaf140c (UNKNOWN) VMwareUser.exe[636] inline wininet.dll!InternetReadFileExA[0x78082ae2] 0x78082ae2 JMP 0xbaf1526 (UNKNOWN) VMwareUser.exe[636] inline wininet.dll!InternetWriteFile[0x78073645] 0x78073645 JMP 0xbaf2d4b (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!NtEnumerateValueKey[0x7c90d2d0] 0x7c90d2d0 JMP 0xbadac6c (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!NtQueryDirectoryFile[0x7c90d750] 0x7c90d750 JMP 0xbae4f20 (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!NtResumeThread[0x7c90db20] 0x7c90db20 JMP 0xbaf625c (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!NtSetInformationFile[0x7c90dc40] 0x7c90dc40 JMP 0xbada9b6 (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!NtVdmControl[0x7c90df00] 0x7c90df00 JMP 0xbae4fd6 (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!ZwEnumerateValueKey[0x7c90d2d0] 0x7c90d2d0 JMP 0xbadac6c (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!ZwQueryDirectoryFile[0x7c90d750] 0x7c90d750 JMP 0xbae4f20 (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!ZwResumeThread[0x7c90db20] 0x7c90db20 JMP 0xbaf625c (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!ZwSetInformationFile[0x7c90dc40] 0x7c90dc40 JMP 0xbada9b6 (UNKNOWN) VMwareUser.exe[636] inline ntdll.dll!ZwVdmControl[0x7c90df00] 0x7c90df00 JMP 0xbae4fd6 (UNKNOWN) VMwareUser.exe[636] inline crypt32.dll!PFXImportCertStore[0x77aeff8f] 0x77aeff8f JMP 0xbae0b02 (UNKNOWN) VMwareUser.exe[636] inline user32.dll!TranslateMessage[0x7e418bf6] 0x7e418bf6 JMP 0xbadc47f (UNKNOWN) VMwareUser.exe[636] inline advapi32.dll!CryptEncrypt[0x77dee340] 0x77dee340 JMP 0xbaeda23 (UNKNOWN) VMwareUser.exe[636] inline ws2_32.dll!send[0x71ab4c27] 0x71ab4c27 JMP 0xbaee35d (UNKNOWN) ctfmon.exe[768] inline ntdll.dll!NtClose[0x7c90cfd0] 0x7c90cfd0 JMP 0xa003b2 (UNKNOWN) ctfmon.exe[768] inline ntdll.dll!ZwClose[0x7c90cfd0] 0x7c90cfd0 JMP 0xa003b2 (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!NtEnumerateValueKey[0x7c90d2d0] 0x7c90d2d0 JMP 0xbadac6c (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!NtQueryDirectoryFile[0x7c90d750] 0x7c90d750 JMP 0xbae4f20 (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!NtResumeThread[0x7c90db20] 0x7c90db20 JMP 0xbaf625c (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!NtSetInformationFile[0x7c90dc40] 0x7c90dc40 JMP 0xbada9b6 (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!NtVdmControl[0x7c90df00] 0x7c90df00 JMP 0xbae4fd6 (UNKNOWN) wmiprvse.exe[1876] inline ntdll.dll!ZwEnumerateValueKey[0x7c90d2d0] 0x7c90d2d0 JMP 0xbadac6c (UNKNOWN) Thanks

14 years, 5 months

2
1
0 0

Re: [Vol-users] profile based plugin list

by Jamie Levy

> Is there list of plugins on a per profile basis. > For eg. connections, sockscan, sockets don't work for Windows 7 dumps. I > didnot know this and was wondering what would've gone wrong > > > -- > Eknath Venkataramani We have most of the plugins broken down here (note the "OS Support" column): http://code.google.com/p/volatility/wiki/FeaturesByPlugin Also you can often see notes like that here: http://code.google.com/p/volatility/wiki/CommandReference All the best, -gleeda

14 years, 6 months

2
1
0 0

profile based plugin list

by Eknath Venkataramani

Is there list of plugins on a per profile basis. For eg. connections, sockscan, sockets don't work for Windows 7 dumps. I didnot know this and was wondering what would've gone wrong -- Eknath Venkataramani

14 years, 6 months

1
0
0 0

Identifying HIPS process injection

by Darren Spruell

I've got a suspect process running on a system. 0x0703fcb8 8880792.tmp 5940 1504 0x0b353000 2011-05-27 07:00:12 %Windir%\Temp\8880792.tmp It's 64K on disk and looks like it's packed with Armadillo: File Name: 8880792.tmp File Size: 65536 File Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5 Hash: fec737234a47ae90ee79af44d3081a4d SHA1 Hash: 4fb9abf6aba05ec1232b98ab39073c7635f7b9aa Cymru MHR: Not listed Packer ID(s): => Armadillo v1.71 Number of sections: 3 -------------------- ('.text\x00\x00\x00', '0x1000', '0xb446', 49152) ('.rdata\x00\x00', '0xd000', '0x15d2', 8192) ('.data\x00\x00\x00', '0xf000', '0x20c0', 4096) I dump process memory (procmemdump) and end up with strings not much different than what I get for the file on disk. The procmemdump output is about 10K larger. The memdump output is 245M and going through the addressable memory contents I get loads of suspicious data that looks like it's related to malware. Samples: are\EES\BIFROST //sharedfreehosting.c USER remote hello keypublic WEBCAM Ekran.png Ekran.bmp 60.167.78.224 www.proxyserverlist.biz proxy_checker/index.php ClientSocket www.66444.com open ww4.tmdqq.net/51lin www3.57185.com/is686_.h 1.hao591.net/is6 exefile=cdb.exe dllfile=test.dll regedits=stubpath tp://bravor.net w.ya.ru whatismyip.co Welcom to BackDor serv by emPyte Fan666` . tem\lsass.ex ion\Run *sniff* sad yo, PRIVMSG Splinter ddos v1.0 INFECT Plus! terra.com.mx send.aspx?id= Windll22.exe !reboot !reconnect !join !pwl !connection !switch !chatslaves Connected to NetShadow v1.2 Server ID: F:\Work\TEST MyFunlove \calc.ex LAgPCfAGCxoRI CwgMCA8JERAO9x Chat-Fenster pcinfo Resolution: tmdqq.net 57185.com szfocus.net cool-pic.com dcomScaner Vortex1 mazafaka GONNA BE AN IRCF HTTP://WWW.ASEXVIDEO HACKTOOLZ ?ACTION=LOGIN&SEND= ICQBETA I suppose though that this is data from the HIPS application that has been injected into this executable's process space. The same strings are present in the memory space of all processes. I want to confirm this by finding an indicator in the process memory that attributes this data to the HIPS application. What is the best way to do this? My initial suspicion is that the VAD table could show me that. Is this right? How could this analysis proceed in Volatility? The 'modules' plugin shows me a couple of entries that I suspect relate to it. 0x8a3c01e8 mfehidk.sys 0x00f70a9000 0x052000 mfehidk.sys 0x89030a20 \SystemRoot\system32\drivers\mfetdik.sys 0x00f7697000 0x00e000 mfetdik.sys 0x89237e68 \Device\mfehidk01.sys 0x00b7f38000 0x053000 mfehidk01.sys -- Darren Spruell phatbuckett(a)gmail.com

14 years, 6 months

2
1
0 0

stuxnet.vmem and VMware

by G. Scott Graham

MHL has been helpful in the past, but I thought I would throw this one out to a wider audience. Simply put, I asked my sysadmin, who has helped me set up my VMware environment, to set up an XP SP3 VM and load stuxnet.vmem as the suspended memory image. VMware crapped out with "A fault has occurred causing the virtual CPU to enter the shutdown state. ..." Does anyone have any insight here? Is stuxnet.vmem the suspended memory image of a Stuxnet infected XP SP3 machine? If it had worked, I wanted to get sysinternals running on the VM, so that I would have sysinternals and Volatility insight into Stuxnet -- although not approaching what Mark Russinovitch was able to show with booting up the machine and infecting it from the start. For educational purposes, for the class I am teaching. Thanks for any guidance, VMware or stuxnet. bfn -- Professor G. Scott Graham administratively: Dean's Designate for Academic Offences academically: Associate Professor, Computer Science and Forensic Science University of Toronto Mississauga

14 years, 6 months

2
1
0 0

Re: [Vol-users] how does malfind plugin work

by malware monna

Hi Curt/Michael, Thanks for the reponse, i need little bit of help, as i'm new to memory forensics...i need your help in understanding how to interpret the results ....any material on additional information on this topic will be helpful Thanks, Monnappa On Tue, Oct 25, 2011 at 9:55 AM, Curt Wilson <research(a)perpetualhorizon.org>wrote: > > > Michael Ligh responded, but it's possible that you might need more > explanation. While I'm not an expert, I'm getting better and would be glad > to try to help you understand the assembly if necessary. Let me know and > I'll see if I can help, if you don't already have it down. > > > > > > > On 10/22/2011 3:17 PM, malware monna wrote: > > Hi All, > > I'm new to volatility and i was reading one of the article on the > internet and found the below output, so i was curious to know what does > below ouput mean?, can anybody please help me understand the malfind pluging > and the below ouput, any info would be useful. > > > --------------------------------------------------------------------------------------------------------------------------------------- > > VMwareTray.exe 432 0x00e30000 0xe30fff00 VadS 0 > PAGE_EXECUTE_R > EADWRITE > Dumped to: c:\re\zeus_demo\VMwareTray.exe.4be97e8.00e30000-00e30fff.dmp > 0x00e30000 b8 35 00 00 00 e9 cd d7 ad 7b b8 91 00 00 00 e9 > .5.......{...... > > 0x00e30010 4f df ad 7b 8b ff 55 8b ec e9 ef 17 3e 76 8b ff > O..{..U.....>v.. > > 0x00e30020 55 8b ec e9 95 76 39 76 8b ff 55 8b ec e9 be 53 > U....v9v..U....S > > 0x00e30030 3a 76 8b ff 55 8b ec e9 d6 18 3e 76 8b ff 55 8b > :v..U.....>v..U. > > 0x00e30040 ec e9 14 95 39 76 8b ff 55 8b ec e9 4f 7e 3c 76 > ....9v..U...O~<v > > 0x00e30050 8b ff 55 8b ec e9 0a 32 3a 76 8b ff 55 8b ec e9 > ..U....2:v..U... > > 0x00e30060 7d 61 39 76 6a 2c 68 b8 8d 1c 77 e9 01 8c 39 76 > }a9vj,h...w...9v > > 0x00e30070 8b ff 55 8b ec e9 c4 95 c8 70 8b ff 55 8b ec e9 > ..U......p..U... > > Disassembly: > 00e30000: b835000000 MOV EAX, 0x35 > 00e30005: e9cdd7ad7b JMP 0x7c90d7d7 > 00e3000a: b891000000 MOV EAX, 0x91 > 00e3000f: e94fdfad7b JMP 0x7c90df63 > 00e30014: 8bff MOV EDI, EDI > 00e30016: 55 PUSH EBP > 00e30017: 8bec MOV EBP, ESP > 00e30019: e9ef173e76 JMP 0x7721180d > 00e3001e: 8bff MOV EDI, EDI > 00e30020: 55 PUSH EBP > > --------------------------------------------------------------------------------------------------------------------------------------------- > > Thanks > > > _______________________________________________ > Vol-users mailing listVol-users@volatilityfoundation.orghttp://lists.volatilityfoundation.org/mailman/listinfo/vol-users > > > > -- > Curt Wilson > Research Analyst, Arbor Networks ASERT cwilson(a)arbor.net > Personal Security Research: research(a)perpetualhorizon.org > >

14 years, 6 months

1
0
0 0

Need some assistance with strings output

by Tom Yarrish

Hello all, I'm looking for some guidance on next steps with some data I have from a memory analysis. I was following the steps on using strings to look for processes that might have malicious IP's or URL's in memory: https://code.google.com/p/volatility/wiki/CommandReference#strings The issue I'm having now is where to proceed with the output I have. So for example in my URL.txt file I have this: 1b64666b7 [2632:834520759] http://ghc.ru 1b646674d [2632:834520909] http://rst.void.ru Now my understanding of the output is [PID:Address Space]. The particular PID in this instance refers to: 0x89c82020 WINWORD.EXE 2632 2284 11 943 2011-10-11 15:07:13 So how do I go deeper in to looking at why winword.exe may be making http requests? And what does the first value (ex 1b64666b7) refer to? Is that the virtual address in the memory dump file or something else? If there's any additional docs online I could look at to explain this further that would be helpful as well. Thanks ahead of time, Tom

14 years, 6 months

1
0
0 0

how does malfind plugin work

by malware monna

Hi All, I'm new to volatility and i was reading one of the article on the internet and found the below output, so i was curious to know what does below ouput mean?, can anybody please help me understand the malfind pluging and the below ouput, any info would be useful. --------------------------------------------------------------------------------------------------------------------------------------- VMwareTray.exe 432 0x00e30000 0xe30fff00 VadS 0 PAGE_EXECUTE_R EADWRITE Dumped to: c:\re\zeus_demo\VMwareTray.exe.4be97e8.00e30000-00e30fff.dmp 0x00e30000 b8 35 00 00 00 e9 cd d7 ad 7b b8 91 00 00 00 e9 .5.......{...... 0x00e30010 4f df ad 7b 8b ff 55 8b ec e9 ef 17 3e 76 8b ff O..{..U.....>v.. 0x00e30020 55 8b ec e9 95 76 39 76 8b ff 55 8b ec e9 be 53 U....v9v..U....S 0x00e30030 3a 76 8b ff 55 8b ec e9 d6 18 3e 76 8b ff 55 8b :v..U.....>v..U. 0x00e30040 ec e9 14 95 39 76 8b ff 55 8b ec e9 4f 7e 3c 76 ....9v..U...O~<v 0x00e30050 8b ff 55 8b ec e9 0a 32 3a 76 8b ff 55 8b ec e9 ..U....2:v..U... 0x00e30060 7d 61 39 76 6a 2c 68 b8 8d 1c 77 e9 01 8c 39 76 }a9vj,h...w...9v 0x00e30070 8b ff 55 8b ec e9 c4 95 c8 70 8b ff 55 8b ec e9 ..U......p..U... Disassembly: 00e30000: b835000000 MOV EAX, 0x35 00e30005: e9cdd7ad7b JMP 0x7c90d7d7 00e3000a: b891000000 MOV EAX, 0x91 00e3000f: e94fdfad7b JMP 0x7c90df63 00e30014: 8bff MOV EDI, EDI 00e30016: 55 PUSH EBP 00e30017: 8bec MOV EBP, ESP 00e30019: e9ef173e76 JMP 0x7721180d 00e3001e: 8bff MOV EDI, EDI 00e30020: 55 PUSH EBP --------------------------------------------------------------------------------------------------------------------------------------------- Thanks

14 years, 6 months

2
1
0 0

Trouble with forensic1394 III

by Michael Felber

It seems that Volatility uses a I/O packet size that's to large for my system. Thanks to Freddie Witherden for supporting me. Using a small dumping application (see below) provided by Freddie I was successfully able to dump that 2GiB of RAM. So I transferred this thread to vol-dev. CU Michael

14 years, 9 months

2
1
0 0

Difference between LIST_ENTRY_PTR and LIST_ENTRY

by Eknath Venkataramani

While analyzing a memory snapshot, I saw some objects of the type LIST_ENTRY_PTR and some of the type LIST_ENTRY. From the addresses of those objects, it looked as if LIST_ENTRY_PTRs where the corresponding list heads and the LIST_ENTRY's were simply the nodes in the list. Is this correct? -- Eknath Venkataramani

14 years, 9 months

1
0
0 0

Trouble with forensic1394 II

by Michael Felber

So, a ldconfig later it looks more comfortable but still it does not work: # python vol.py -l Firewire://forensic1394/0 pslist Volatile Systems Volatility Framework 2.1_alpha IOError(u'forensic1394_read_device_v: Bad I/O request size',) IOError(u'forensic1394_read_device_v: Bad I/O request size',) No suitable address space mapping found Tried to open image as: WindowsHiberFileSpace32: No base Address Space EWFAddressSpace: Location is not of file scheme WindowsCrashDumpSpace32: No base Address Space JKIA32PagedMemory: No base Address Space IA32PagedMemoryPae: Module disabled JKIA32PagedMemoryPae: No base Address Space IA32PagedMemory: Module disabled WindowsHiberFileSpace32: Location is not of file scheme EWFAddressSpace: Location is not of file scheme WindowsCrashDumpSpace32: Location is not of file scheme JKIA32PagedMemory - EXCEPTION: Failed to read from firewire device IA32PagedMemoryPae: Module disabled JKIA32PagedMemoryPae - EXCEPTION: Failed to read from firewire device IA32PagedMemory: Module disabled FirewireAddressSpace: Must be first Address Space FileAddressSpace: Must be first Address Space Seems the python bindings were missed in the first approach. What could cause the FW-read-error? Regards Michael -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

14 years, 9 months

2
2
0 0

Trouble with forensic1394

by Michael Felber

Hello all, I have tried the libforensic1394 package from https://freddie.witherden.org/tools/libforensic1394/ with Volatility. That's the result: # python vol.py -l Firewire://forensic1394/0 pslist Volatile Systems Volatility Framework 2.1_alpha No suitable address space mapping found Tried to open image as: WindowsHiberFileSpace32: No base Address Space EWFAddressSpace: Location is not of file scheme WindowsCrashDumpSpace32: No base Address Space JKIA32PagedMemory: No base Address Space IA32PagedMemoryPae: Module disabled JKIA32PagedMemoryPae: No base Address Space IA32PagedMemory: Module disabled FileAddressSpace: Location is not of file scheme What could I have missed? I had expected to to read something about the firewire address space but neither Firewire:... nor firewire:... did work. Regards Michael -- NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie! Jetzt informieren: http://www.gmx.net/de/go/freephone

14 years, 9 months

1
0
0 0

Finding API-Hooks

by Michael Felber

Hey Michael, trying to list the hooked API-calls in the zeus.vmem-image according page 666 of your "Cookbook" with Volatility 2.0 and maware.py r97 I get the following result only: C:\Python27\Scripts>python vol.py apihooks -f "D:\X-Ways-Images\Malware\zeus.vmem" Volatile Systems Volatility Framework 2.0 Name Type Target Value wuauclt.exe[468](a)wuaueng.dll iat sfc.dll!*invalid* 0x0 0x76c69828 (sfc_os.dll) Finished after 383.752000093 seconds Did I miss something or should I use an older version of Volatility and the malware-Plugin? Kindest regards Michael

14 years, 9 months

2
4
0 0

unable to extract process 1336 from prolaco-image

by Michael Felber

Hi, I have tried to extract the process 1336 (1_doc_RCData_61) from the prolaco-Image provided at http://malwarecookbook.googlecode.com/svn-history/r26/trunk/15/6/prolaco.vme m.zip Neither procexedump nor procmemdump did work for this process but for any other. What went wrong? Regards Michael

14 years, 9 months

2
2
0 0

Versions 1.3, 1.4 and 2.0

by macubergeek

I'm new to volatility and recently completed a SANS course which taught v. 1.3. I'm trying to straighten out in my head the different sets of plugins that come with each version. It looks like v. 2.0 absorbed some older third party plugins but didn't absorb others like malfind.py and the other malware related third party plugins. Am I right here? It appears one has to have all three versions available for different feature sets? Is this correct? Jim ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ %49%66%20%79%6F%75%20%63%61%6E%20%72%65%61%64%20%74%68%69%73%20%79%6F%75%20%6E%65%65%64%20%74%6F%20%67%65%74%20%61%20%67%69%72%6C%66%72%69%65%6E%64%2E

14 years, 9 months

5
5
0 0

feature request: Output in Dot-Format for psscan

by Michael Felber

Hello, in 1.4rc1 there was a nice feature to visualize the output of psscan in the GraphViz-dot-format with -output=dot. I have used it frequently to explain memory structures to non IT-Experts or for training purposes. Is it possible to add this feature to Version 2.0 again, please? Cu Michael

14 years, 9 months

1
0
0 0

files-command missed

by Michael Felber

Hi all, In v2.0 I miss the files-command. As a workaround I use C:\Python27\Scripts>python vol.py handles -p 816 -f . | grep -i "File" "files" was easier to use. Why it has gone? Cu Michael

14 years, 9 months

2
2
0 0

Solved: *** Failed to import volatility.plugins.registry.lsadump

by Michael Felber

The problem is solved: I still had a 64-bit-version of PyCrypto installed, with the x(86)-version all seems to work fine and the hashdump/lsadump-plugins appear again. Shame on me! CU Michael

14 years, 9 months

1
0
0 0

hivedump, lsadump and hashdump

by Michael Felber

Hi all, when will the plugins hivedump, lsadump and hashdump be available in v2.0? Or is there another way to extract that data? Cu Michael

14 years, 9 months

1
0
0 0

Error importing plugins.registry.lsadump

by Michael Felber

Hello all, finally I found time to test the new version 2.0. It looks great even if I became familiar with the old structure. I tried to use it on an 64Bit-Win7 with Python64. This seems not to work but after installing the x(86)-architecture it does. However when starting v2.0 with I get the following error message: *** Failed to import volatility.plugins.registry.lsadump (ImportError: DLL load failed: %1 ist keine zulõssige Win32-Anwendung [transl.: %1 is no valid win32 application] What went wrong? Regards Michael

14 years, 9 months

1
0
0 0

Re: Vol-users Digest, Vol 39, Issue 1

by Shafik Punja

Mike - thanks so much for replying *************************************************************************************************** This is the terminal output for the lipo commands: qbl-mbp:~ qubyte$ lipo -info /usr/local/lib/libewf.dylib Non-fat file: /usr/local/lib/libewf.dylib is architecture: x86_64 qbl-mbp:~ qubyte$ lipo -info `which python` Architectures in the fat file: /Library/Frameworks/Python.framework/Versions/2.6/bin/python are: ppc i386 *************************************************************************************************** Output from from the versioner command: qbl-mbp:volatility2.0 qubyte$ VERSIONER_PYTHON_PREFER_32_BIT=yes python vol.py -h Volatile Systems Volatility Framework 2.0 *** Failed to import volatility.plugins.addrspaces.ewf (OSError: dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find: /usr/local/lib/libewf.dylib: mach-o, but wrong architecture) I have also cc'd Joachim Metz on this in case he has some insight. Joachim - in case you have time to read this i am encountering this error with libewf and volatility 2.0 when running volatitlity (mac ox 10.6.8 with libewf 20100226; this version of libewf is used to due to TSK 3.2.2): *** Failed to import volatility.plugins.addrspaces.ewf (OSError: dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find: /usr/local/lib/libewf.dylib: mach-o, but wrong architecture) Thanks to the vol group and joachim for taking the time to read this! I look forward to the next set of ideas! :) Cheers Shafik On Tue, Aug 9, 2011 at 11:00 AM, <vol-users-request(a)volatilityfoundation.org>wrote: > lipo -info `which python`

14 years, 9 months

3
4
0 0

Minor issue running volatility 2.0 on Mac OX 10.6.8 (Intel)

by Shafik Punja

Hello List! I have been fighting with this issue since volatility 1.4 RC1. I am not able to figure out why it cannot locate the correct libewf library. I have uninstalled and reinstalled from source the libewf 20100226 stable version. Can anyone assist me with this Terminal output: qbl-mbp:volatility2.0 qubyte$ python vol.py -h Volatile Systems Volatility Framework 2.0 *** Failed to import volatility.plugins.addrspaces.ewf (OSError: dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find: /usr/local/lib/libewf.dylib: mach-o, but wrong architecture) Usage: Volatility - A memory forensics analysis platform. OS: Mac OS X 10.6.8 Python: qbl-mbp:~ qubyte$ python Python 2.6.6 (r266:84374, Aug 31 2010, 11:00:51) [GCC 4.0.1 (Apple Inc. build 5493)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>> Any help would be greatly appreciated...and please dont assume that I know my well around terminal shell..I am still a newbie and learning lots! Thanks! Shafik __________________________________ Shafik Punja BSc, A+, CISSP, Network+, ACE, CCE Senior Technical Officer *QuByte Logic Ltd* 612-500 Country Hills Blvd NE, Suite #404 Calgary, AB CANADA T3K 5K3 ph: 403.909.6120 em: shafghp(a)gmail.com or shafik(a)qubytelogic.com wp: http://www.qubytelogic.com

14 years, 9 months

2
1
0 0

Tracing suspicious mutex back to it's respective process or binary

by macubergeek

All I've had great success using recipes out of the Malware Analyst Cookbook. I particularly like the recipe involving mutantscandb and compare the mutexes in a binary under investigation with those in my sqlite3 database. Can anyone tell me how to trace the observed suspicious mutexes in a mutantscandb scan with the process/binary that owns that mutex? Jim ~~~~~~~~~~~~~~~~~~~~~~ ACK and you shall receive

14 years, 10 months

2
1
0 0

Process Memory - memdmp

by Derek Lee

Hi all, I'm using "Volatility-1.3_Beta" in a college project. I have a question regarding the 'memdmp' module. I use a 1GB memory dump from Windows XP SP2. Dumped using the tool win32dd. After extracting the list of running processes, I dump the addressable memory for each process using the command: python volatility memdmp -f *my_1GB_memory_dump *-p 1234 The output for each process is a very large PID.dmp. On average each PID.dmp is about 200MB. So, after extracting the memory for the first 5 processes (out of a total of 64 processes), I have already exceeded the size of the RAM dump (1 GB). I know that some processes will use DLL's and that this may become part of the addressable memory for that process. But can anyone explain to me why the dump files are so large? Is it possible to just extract memory for each process so that the total is approx. equal to the RAM dump? Looking at the code for mem_dump, I can see: File: vmodules.py mem_dump(...) ... entries = process_address_space.get_available_pages() for entry in entries: data = process_address_space.read(entry[0],entry[1]) ohandle.write("%s"%data) File: forensics/x86.py def get_available_pages(self): page_list = [] pgd_curr = self.pgd_vaddr for i in range(0,ptrs_per_pgd): start = (i * ptrs_per_pgd * ptrs_per_pte * 4) entry = self.read_long_phys(pgd_curr) pgd_curr = pgd_curr + 4 if self.entry_present(entry) and self.page_size_flag(entry): page_list.append([start, 0x400000]) elif self.entry_present(entry): pte_curr = entry & ~((1 << page_shift)-1) for j in range(0,ptrs_per_pte): pte_entry = self.read_long_phys(pte_curr) pte_curr = pte_curr + 4 if self.entry_present(pte_entry): page_list.append([start + j * 0x1000, 0x1000]) return page_list I'm not a Python programmer, but it appears that the method: get_available_pages() is searching across the 4KB page files, looking for physical addresses belonging to the specific process. Then the data at these physical addresses is extracted. The lower level details of these commands are currently beyond my reach. Any help is greatly appreciated, Regards, Derek.

14 years, 10 months

2
1
0 0

OMFW 2011 - Registration Open

by AAron Walters

vol-users: I wanted to give you the inside track on registering for OMFW. Tomorrow, I will be posting the announcement to the Volatility tumblr for wider distribution. Pre-registration is required and space is limited, so register early. https://www.volatilityfoundation.org/default/omfw Volatile memory forensics (ie., RAM forensics) has proven one of the most exciting and important topics to the future of digital investigations. It has dramatically transformed the way we perform digital investigations and helped provide a path for addressing many of the challenges we currently face. OMFW is the only digital forensics workshop focused on providing a venue for the most advanced digital investigators. It is intended for those people who realize that the only real defense against a creative technical human adversary is a creative technical human analyst. No shady vendors trying to describe how they re-implemented open source tools or boisterous trainers attempting to discuss topics they only superficially understand. This is your opportunity to learn directly from an international cadre of pioneering researchers and practitioners who have been shaping the field of memory analysis since its inception. Through a series of invited talks and panel discussions you will have the opportunity to engage this exciting community. At the end of the day, the attendees will have the opportunity to work through a challenging memory analysis skills exercise with the assistance of your expert speakers. Join with industry leaders to discuss the latest advancements in memory forensics and the importance of open source initiatives. This is your opportunity to help shape the future of memory forensics! AW

14 years, 11 months

1
0
0 0

Volatility Report for Windows

by Chris Bentley

HI all, I've just started taking a more active look at using Volatility and I though I would point people in the direction of a new windows batch script I've created (Its based on the one from lg's blog ). Feel free to post any improvements, I already have a few things I have in mind to update the script. Blog Post: http://active-security.blogspot.com/2011/05/volatility-script-for-windows.h… Script location: https://docs.google.com/leaf?id=0Bz2rZ4S-yK8AMDE5ODhhMzEtOGNhMS00N2U3LWEyMz…

14 years, 11 months

1
0
0 0

cf Help volatility

by L Gordon

Suggest: a) read volatility wiki doc b) buy Malware Analyst's Cookbook Michael Hale Ligh et al Wiley 716 pg lorgor

15 years

1
0
0 0

Release of reglist.py plugin v1.41

by L Gordon

Just to mention that have written a python port of Regripper for Volatility 1.4: reglist.py Latest version is 1.41. Updated to have more reliable os determination from profile. Description is here: http://code.google.com/p/lgvtotal/wiki/ReglistPlugin Download here: http://code.google.com/p/lgvtotal/downloads/list

15 years

1
0
0 0

Re: [Vol-users] Open Memory Forensics Workshop (OMFW) 2011

by AAron Walters

Curt, You always ask the good questions...We are currently in the process of finalizing the specifics of the logistics. My goal was to get this email out and see if there was anyone else interested in speaking. I will send an update by the end of the week discussing the "where and when..". Hope all is well! AW On Wed, 13 Apr 2011, Curt Wilson wrote: > > AAron, > > Is there a date and location? > > Thanks > Curt Wilson > > > On 4/12/2011 10:21 PM, AAron Walters wrote: >> >> After the amazing success of OMFW 2008 and a <cough>little</cough> >> hiatus, we are currently in the process of planning OMFW 2011. OMFW is >> the single most important event for those who are interested in the >> deep technical aspects of digital investigations and forensics. It is >> intended for those people who realize the only real defense against a >> creative technical human adversary is creative technical human >> analyst. No shady vendors trying to describe how they re-implemented >> open source tools or boisterous trainers attempting to discuss topics >> they only superficially understand. This is your opportunity to learn >> directly from an international cadre of pioneering researchers and >> practitioners who have been shaping the field of memory analysis since >> its inception. >> >> If you are interested in getting involved or have an exciting topic >> you would like to present, please let the team know. For those who >> want to attend, please be sure to check back frequently for >> registration details. Due to the overwhelming response in 2008, we >> were not able to fulfill all the registration requests, so please be >> sure to register early! There will be a number of surprises and I >> guarantee it will be an event you won't want to miss! Check out what >> previous attendees of OMFW have said: >> >> "AAron was able to bring together an outstanding group of folks >> interested in "memory forensics" and there was some spirited >> discussion among the participants along with some really outstanding >> talks/demos. It was also great to be able to put faces to folks who >> until then had only been handles in IRC or names on e-mail/blog posts >> in the past." >> -Jim Clausing: SANS Internet Storm Center Handler >> >> "My first impression of the event was that the underground could have >> set digital forensics back 3-5 years if they had attacked our small >> conference room. Where else do you have Eoghan Casey, Brian Carrier, >> Harlan Carvey, Michael Cohen, Brendan Dolan-Gavitt, George Garner Jr., >> Jesse Kornblum, Andreas Schuster, Aaron Walters, et al, in the same >> room? I thought Brian Dykstra framed the situation properly when >> asking the following: "I know this is an easy question for all you >> 'beautiful minds,' but..."" >> -Richard Bejtlich: TaoSecurity >> >> >> Current invited speakers include: >> >> Andrew Case (attc) >> Michael Cohen (scudette) >> Brendan Dolan-Gavitt (moyix) >> Jamie Levy (gleeda) >> Michael Hale Ligh (MHL) >> AAron Walters >> >> More to be announced.... >> >> _______________________________________________ >> Vol-users mailing list >> Vol-users(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users > > > -- > --- > Curt Wilson - Perpetual Horizon Security Research > SIUC IT Security Officer + Security Engineer >

15 years, 1 month

1
0
0 0

Open Memory Forensics Workshop (OMFW) 2011

by AAron Walters

After the amazing success of OMFW 2008 and a <cough>little</cough> hiatus, we are currently in the process of planning OMFW 2011. OMFW is the single most important event for those who are interested in the deep technical aspects of digital investigations and forensics. It is intended for those people who realize the only real defense against a creative technical human adversary is creative technical human analyst. No shady vendors trying to describe how they re-implemented open source tools or boisterous trainers attempting to discuss topics they only superficially understand. This is your opportunity to learn directly from an international cadre of pioneering researchers and practitioners who have been shaping the field of memory analysis since its inception. If you are interested in getting involved or have an exciting topic you would like to present, please let the team know. For those who want to attend, please be sure to check back frequently for registration details. Due to the overwhelming response in 2008, we were not able to fulfill all the registration requests, so please be sure to register early! There will be a number of surprises and I guarantee it will be an event you won't want to miss! Check out what previous attendees of OMFW have said: "AAron was able to bring together an outstanding group of folks interested in "memory forensics" and there was some spirited discussion among the participants along with some really outstanding talks/demos. It was also great to be able to put faces to folks who until then had only been handles in IRC or names on e-mail/blog posts in the past." -Jim Clausing: SANS Internet Storm Center Handler "My first impression of the event was that the underground could have set digital forensics back 3-5 years if they had attacked our small conference room. Where else do you have Eoghan Casey, Brian Carrier, Harlan Carvey, Michael Cohen, Brendan Dolan-Gavitt, George Garner Jr., Jesse Kornblum, Andreas Schuster, Aaron Walters, et al, in the same room? I thought Brian Dykstra framed the situation properly when asking the following: "I know this is an easy question for all you 'beautiful minds,' but..."" -Richard Bejtlich: TaoSecurity Current invited speakers include: Andrew Case (attc) Michael Cohen (scudette) Brendan Dolan-Gavitt (moyix) Jamie Levy (gleeda) Michael Hale Ligh (MHL) AAron Walters More to be announced....

15 years, 1 month

1
0
0 0

Need Help

by kal maun

Hi All, I've been using Volatility few days ago, and I'm still new at this time. and until now I only use it only to look at it with regular orders...like 1. pslist 2. files 3.connections 4.etc. And I know, the information obtained from the volatility by the extraction of digital artifacts from volatile memory (RAM) is very useful in the investigation, but I do not know how to utilize, maximize, and use that information obtained by the volatility. and I know, here is the place of great people who can teach me how to better optimize the extraction of information on the results of volatility. Is there that can help me to better optimize the volatility ... please help me. I will very grateful for all help. Regards. Kalmaun.

15 years, 2 months

1
0
0 0

Issue installing 1.4RC1

by Michael Felber

Hello all, After I had changed to Win7 64 I've tried to install Volatility 1.4RC1 doing the following: - installing Python 2.7 x64 - installing a precompiled pccrypto 2.3.1 x64 bit from http://archive.warshaft.com/pycrypto-2.3.1.win7x64-py2.7x64.7z - compiling the modules did not work. - getting rc1 via wget and via SVN-checkout both When starting Volatility I get the following error message: C:\Micha\Forensics\Volatility-14rc1>python volatility C:\Python27\python.exe: can't find '__main__' module in 'volatility' What went wrong? Cu Michael

15 years, 3 months

2
2
0 0

Re: [Vol-users] Problem converting hiberfil.sys

by Christian Herndler

Thanks for your suggestion. I did try hibr2bin.exe, that didn't work either (error was: "Failed. Cannot open file. Please check if the file is not being used") The first page (4096 Byte) of the file is empty - but as far as I know that shouldn't be a problem. Christian On 11/17/2010 02:40 PM, Johnathan Bridbord wrote: > Christian- > > Perhaps try the following syntax: > > #python volatility hibinfo -f /tmp/hiberfil.sys -d /tmp/hiberfil.dd > > I recommend Matt's standalone windows executable hibr2bin from moonsol. > > Thanks, > JB > Sent via BlackBerry by AT&T > > -----Original Message----- > From: Christian Herndler <christian(a)herndler.com> > Sender: vol-users-bounces(a)volatilityfoundation.org > Date: Wed, 17 Nov 2010 08:55:24 > To: <vol-users(a)volatilityfoundation.org> > Subject: [Vol-users] Problem converting hiberfil.sys > > Hello, > > I tried to convert a hiberfil.sys from WindowsXP SP0 German and get the > following error: > > . > /volatility hibinfo -f /tmp/hiberfil.sys -d /tmp/hiberfil.dd > Traceback (most recent call last): > File "./volatility", line 219, in <module> > main() > File "./volatility", line 212, in main > modules[argv[1]].execute(argv[1], argv[2:]) > File "/opt/Volatility/vmodules.py", line 62, in execute > self.cmd_execute(module, args) > File "/opt/Volatility/vmodules.py", line 1616, in hibinfo > hiberAS = WindowsHiberFileSpace32(fileAS,0,0) > File "/opt/Volatility/forensics/win32/hiber_addrspace.py", line 146, > in __init__ > for i in range(0,EntryCount): > OverflowError: range() result has too many items > > any ideas ? > > Christian > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

15 years, 6 months

3
3
0 0

Problem converting hiberfil.sys

by Christian Herndler

Hello, I tried to convert a hiberfil.sys from WindowsXP SP0 German and get the following error: . /volatility hibinfo -f /tmp/hiberfil.sys -d /tmp/hiberfil.dd Traceback (most recent call last): File "./volatility", line 219, in <module> main() File "./volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "/opt/Volatility/vmodules.py", line 62, in execute self.cmd_execute(module, args) File "/opt/Volatility/vmodules.py", line 1616, in hibinfo hiberAS = WindowsHiberFileSpace32(fileAS,0,0) File "/opt/Volatility/forensics/win32/hiber_addrspace.py", line 146, in __init__ for i in range(0,EntryCount): OverflowError: range() result has too many items any ideas ? Christian

15 years, 6 months

1
0
0 0

[Vol-dev] New memory profile question

by neofito

Following the instructions provided by Bradley Schatz [1] I added a new profile for Windows Vista SP2. since the code is actively revised it's obvious that not all commands work how is expected, but I'm very surprised that the command kpcrscan always get the same value: C:\Volatility-1.4_rc1>volatility.py --profile=VistaSP2x86 -f vistasp2.dmp kpcrscan Volatile Systems Volatility Framework 1.4_rc1 Potential KPCR structure virtual addresses: Phys addr 00150000 Virt addr ffdff000 _KPCR: ffdff000 obviously this is not correct 0: kd> !pcr KPCR for Processor 0 at 81d45800: Major 1 Minor 1 NtTib.ExceptionList: ffffffff NtTib.StackBase: 00000000 NtTib.StackLimit: 00000000 NtTib.SubSystemTib: 80151000 NtTib.Version: 001d39f9 NtTib.UserPointer: 00000001 NtTib.SelfTib: 00000000 SelfPcr: 81d45800 Prcb: 81d45920 Irql: 00000002 IRR: 00000000 IDR: ffffffff InterruptMode: 00000000 IDT: 81bff400 GDT: 81bff000 TSS: 80151000 CurrentThread: 81d49640 NextThread: 00000000 IdleThread: 81d49640 DpcQueue: The volatility code version is the latest available via subversion (r493). [1] http://blog.schatzforensic.com.au/2010/05/adding-new-structure-definitions-… --- La verdad nos hara libres http://neosysforensics.blogspot.com http://www.wadalbertia.org -<|:-P[G]

15 years, 7 months

1
1
0 0

New memory profile question

by neofito

First, sorry for my poor english :( Following the instructions provided by Bradley Schatz [1] I dont get load the new profile: C:\Volatility-1.4_rc1>dir plugins\overlays\Windows\vista_* ... 26/09/2010 22:47 2.232 vista_sp0_x86.py 26/09/2010 22:48 2.357 vista_sp0_x86.pyc 26/09/2010 22:47 286.008 vista_sp0_x86_vtypes.py 26/09/2010 22:48 192.774 vista_sp0_x86_vtypes.pyc 01/10/2010 23:18 2.235 vista_sp2_x86.py 01/10/2010 23:19 2.360 vista_sp2_x86.pyc 01/10/2010 22:36 315.748 vista_sp2_x86_vtypes.py 01/10/2010 23:19 207.429 vista_sp2_x86_vtypes.pyc ... C:\Volatility-1.4_rc1>volatility.py --info Volatile Systems Volatility Framework 1.4_rc1 ... PROFILES -------- VistaSP0x86 - A Profile for Windows Vista SP0 x86 Win7SP0x86 - A Profile for Windows 7 SP0 x86 WinXPSP2 - A Profile for Windows XP SP2 WinXPSP3 - A Profile for windows XP SP3 ... What am I doing wrong? [1] http://blog.schatzforensic.com.au/2010/05/adding-new-structure-definitions-… --- La verdad nos hara libres http://neosysforensics.blogspot.com http://www.wadalbertia.org -<|:-P[G]

15 years, 7 months

2
1
0 0

Unable to locate valid DTB in image

by Zack Sheikh

Hi i am using dfrws forensic challenge image from 2005 (both images). when I tried any option (pslist, connections etc) i get Unable to locate valid DTB in image. When i use psscan or connscan, i get no output. i am using volatility version 1.3 on Ubuntu. Zack

15 years, 8 months

1
0
0 0

Please Ignore

by AAron Walters

Test AW

15 years, 8 months

1
1
0 0

Cannot read/dump modules

by Tora

Hi there, I'm trying to code an small tool to interact with users, hash modules and dump them... but this last part is not working properly. I have in my code something like: (self.addr_space, self.symtab, self.types) = vutils.load_and_identify_image(self.op, self.opts) ... for module in modules_list(self.addr_space, self.types, self.symtab): ... driver_base = module_baseaddr(self.addr_space, self.types, module) driver_size = module_imagesize(self.addr_space, self.types, module) data = self.addr_space.read(driver_base, driver_size) The problem is that using this code, data is always None. Tracing a bit I found that is because at some point, one of the pages cannot be read because a call to vtop return None (PTE = 0 for that page, but it shouldn't be). I've been testing the code with different memory images and I even get the same behaviour when testing it with NIST's xp-laptop dumps, so I'm quite sure it's not because a weird memory dump. So, any ideas of what I'm doing wrong? Also any hint about the best way of use the API would be nice. I mean, I'm using calls to module_baseaddr while other code I saw (moddump by moyix) uses things like mod.BaseAddress.v() Thanks, Tora

15 years, 9 months

2
1
0 0

Re: [Vol-users] Third Party plugins

by Jamie Levy

Hi Mark, Did you install the registry plugins (that contain hivescan)? Make sure you get all supporting libraries installed. You can check Moyix's blogpost (http://moyix.blogspot.com/2009/01/memory-registry-tools.html) on how to install/use it and there are also installation manuals on the Documentation wiki that cover it as well (http://code.google.com/p/volatility/wiki/DocFiles) Also, you may want to use the framework from the SVN (http://code.google.com/p/volatility/source/checkout) if you haven't already (there's also documentation on how to use SVN on the documenation wiki)... As Darren also said, the forensics wiki (http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins) has a pretty good list of current Volatility plugins. All the best, -gleeda > Date: Mon, 28 Jun 2010 22:09:02 +0000 (UTC) > From: mark-wade(a)comcast.net > Subject: [Vol-users] Third Party plugins > To: vol-users(a)volatilityfoundation.org > Message-ID: > <1973170622.78668.1277762942105.JavaMail.root(a)sz0109a.westchester.pa.mail.comcast.net> > > Content-Type: text/plain; charset="utf-8" > > > > Hello, > > > > I am trying to see if there is a list or repository anywhere for third party plugins . Also, I am running the hivescan with the1.3 Beta. I dumped the hivescan plugin package in the Volatility directory, but when I run it I am getting the message: Error: Invalid module [ hivescan ]. Are there any docs to address running third party apps with Volatility ? I am running it on Windows. > > > > Thanks

15 years, 10 months

1
0
0 0

Third Party plugins

by mark-wade＠comcast.net

Hello, I am trying to see if there is a list or repository anywhere for third party plugins . Also, I am running the hivescan with the1.3 Beta. I dumped the hivescan plugin package in the Volatility directory, but when I run it I am getting the message: Error: Invalid module [ hivescan ]. Are there any docs to address running third party apps with Volatility ? I am running it on Windows. Thanks

15 years, 10 months

2
1
0 0

Vista hibernation files

by Howard Patterson

I tried the hibr2dmp utility, but it fails on both my Vista possible hacking hibernation file, as well as a Vista 32-bit test hibernation file. Both contain a block of zeros at the beginning of the file. Howard Patterson Special Agent Technical Services Unit Tennessee Bureau of Investigation 615-744-4376 howard.patterson(a)tn.gov

16 years

2
2
0 0

Vista hibernation files

by Howard Patterson

Is anyone working on extending Volatility to work with Vista? I have a hibernation file from a Vista (32-bit) machine and am searching for possible intrusion/hacking. Don't have ram capture. Howard Patterson Special Agent Technical Services Unit Tennessee Bureau of Investigation 615-744-4376 howard.patterson(a)tn.gov

16 years

1
0
0 0

RE: FTK Lite

by Chris Currier

Bruce, Change the extension from ".txt" to ".bin" or maybe even try ".dmp" and then run Volatility. It has been a while since I have done it, but I believe you will want to use ".bin". Regards, Chris Chris Currier CMT Digital Solutions, Inc.

16 years, 1 month

1
0
0 0

A Volatile Challenge: The Honeynet Project has Banking Troubles

by AAron Walters

The latest forensics challenge for The Honeynet Project involves investigating a memory sample of an infected virtual machine. In order to encourage research and development in the area of memory forensics, The Order of Volatility plans to augment the prizes awarded to those submissions in the top three which leverage The Volatility Framework. Even if you are a Volatility power-user who doesn't find the questions particularly interesting, we still encourage you to participate. To that end, we are also planning to recognize the submission that extends the Volatility Framework in the most unique or creative way (i.e., plugins, visualizations, etc). Submissions are due by 17:00 EST, Sunday, April 18th 2010. Shoutz to Josh Smith, a Volatility supporter, for helping to encourage research in the area of memory forensics! http://www.honeynet.org/challenges/2010_3_banking_troubles

16 years, 1 month

1
0
0 0

Hidden Network connection?

by K Bertens

I did a memory and volatile data acquisition with Helix. While using the enscript version of volatility I found on the blog, I ran it against the memorydump and the TCP network connections scan showed a connection: 192.168.1.104:1142 81.169.145.x:80 3852 The strange thing is, I cant find the process accociated with processid 3852 in the enscript version with pslist. When I run the volatility program from a linux commandline I cant see any connection at all (with the options connscan and connscan2) and there is no process in plist with id 3852. In the volatile data report of Helix this connection isnt showing either. Of course I want to know what kind of process this is, can anyone help me? Thanks a lot, K Bertens

16 years, 1 month

2
1
0 0

Fwd: [linux_forensics] Interested in a Sleuth Kit and Open Source Forensics Users Conference? (fwd)

by AAron Walters

Begin forwarded message: > From: Brian Carrier <carrier(a)digital-evidence.org> > Date: March 2, 2010 10:57:02 AM EST > Subject: [linux_forensics] Interested in a Sleuth Kit and Open Source Forensics Users Conference? > > We are thinking about hosting the first ever Sleuth Kit and Open Source > Forensics Users Conference this year on June 9 in Chantilly, VA (USA). > It would be held in conjunction with the Basis Technology Government > Users Conference (but it will be open to non-Government users). The goal > of the conference would be to announce some new Sleuth Kit features, > learn about how Sleuth Kit is integrated into other tools, learn about > other open source forensics tools, and get some ideas on future > directions of the tools. > > We have commitments from some companies who are willing to talk about > how they are using TSK and I next wanted to get an idea about who was > interested in attending or giving a presentation. Can you send me an > e-mail (off list) if you would be interested in attending or presenting? > If there is enough interest, then we'll see you in June! > > For those who want more location details, here is a link to the Basis > conference site: > http://www.basistech.com/conference/2010/directions.html > > thanks, > brian >

16 years, 2 months

1
0
0 0

Re:[Vol-users] connscan ouput question

by Jamie Levy

Just out of curiosity, was there message text in this email? I didn't get it for some reason... > Date: Mon, 1 Mar 2010 09:31:42 -0600 > From: "Schroeder, William" <William.Schroeder(a)cmegroup.com> > Subject: [Vol-users] connscan ouput question > To: "vol-users(a)volatilityfoundation.org" <vol-users(a)volatilityfoundation.org> > Message-ID: > <B61619049B3B8049A5F883C2822A080C0E11583318(a)SMAPEXMBX2.prod.ad.merc.chicago.cme.com> > > Content-Type: text/plain; charset="us-ascii" > > Skipped content of type multipart/alternative

16 years, 2 months

3
2
0 0

unable to load image

by Meyer, Bruce

I think I know the answer to this, but I want to be certain. I captured live memory with FTK Imager Lite (Current version) I am now trying to examine the memory, and receive: commandme : python volatility connections -f memdump.txt /work/Volatility-1.3_Beta/forensics/win32/crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import sha Usage: connections [options] (see --help) volatility: error: Unable to load image. Possible causes: invalid dtb, wrong image type, unsupported image type. I suspect that FTK doesn't create a linear image. I tried this on a Mac and WIndows. If this is correct, does anyone know of an open source tool I can analyze this ftk memory dump with? I can't recreate another. I tried wmft_0.2 but I think that this tool is in the early stages of development. I was only able to pul a lit of drivers with it. -- Bruce D. Meyer Analysis & Encryption (803) 896-0469 (803) 896-1650 (SOC) My Key Fingerprint is: 8BC3 14B5 CE77 3C83 F4A7 5353 3F27 97FF 0591 44F9 ------------------------- South Carolina Information Sharing and Analysis Center (SC-ISAC) Department of State I.T. (D.S.I.T) http://sc-isac.sc.gov ~-~-~-~-~-~-~-~-~-~-~-~-~- Upload your PGP public key, download or verify mine at: http://keys.cio.sc.gov<http://keys.cio.sc.gov/>

16 years, 2 months

3
2
0 0

connscan ouput question

by Schroeder, William

Has any one seen the following on the output from connscan? The connections are both external and the PID is impossibly high. 73.0.83.0:20992 69.0.71.0:21504 6029401

16 years, 2 months

1
0
0 0

FileObjScan Plugin

by Mark Morgan

While running the above plugin using Vol 1.3.2 I keep getting the following error. It runs just fine for few minutes then I get the error "Range results has too many items." My question, is this expected? or is this a bug? Here is the output: root@morgan-laptop:/digitalforensics/Volatility-1.3.2# ./volatility fileobjscan -f /home/morgan/Raw\ Memory/PhysicalMemory.bin > fileobj.txt Traceback (most recent call last): File "./volatility", line 219, in <module> main() File "./volatility", line 215, in main command.execute() File "/digitalforensics/Volatility-1.3.2/memory_plugins/fileobjscan.py", line 257, in execute scan_addr_space(search_addr_space, scanners) File "/digitalforensics/Volatility-1.3.2/forensics/win32/scan2.py", line 218, in scan_addr_space o.process(chunk,as_offset+poffset, metadata=metadata) File "/digitalforensics/Volatility-1.3.2/forensics/win32/scan2.py", line 148, in process self.process_buffer(buf,self.offset,metadata) File "/digitalforensics/Volatility-1.3.2/forensics/win32/scan2.py", line 425, in process_buffer self.object_action(buff,ooffset) File "/digitalforensics/Volatility-1.3.2/memory_plugins/fileobjscan.py", line 190, in object_action for i in range(count): OverflowError: range() result has too many items Mark Morgan

16 years, 3 months

3
2
0 0

Error when using Printkey

by Mark Morgan

I am trying to use printkey against a Windows XP image and keep getting an error when I use printkey. I have also provided the commands I used for hivescan and hivelist which work great but printkey does not. Does anyone have any suggestions as to why. I initially thought it was because it was SP3 so I ran the same plugins against the xp-laptop-2005-06-25.img that was suggested to use in Brendan's guide but I get the same results. Anyone have any thoughts as to why??? Mark Morgan 702-942-2556 morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$ ./volatility hivescan -f /home/morgan/Memory\ Images/PhysicalMemory.bin Offset (hex) 181006344 0xac9f008 181033824 0xaca5b60 189972488 0xb52c008 202671368 0xc148508 544586592 0x2075bb60 642878304 0x26518b60 643895304 0x26611008 678736920 0x2874b418 740933640 0x2c29c008 742706016 0x2c44cb60 789179232 0x2f09eb60 798029088 0x2f90f520 1107776776 0x42075508 1874516240 0x6fbad910 morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$ ./volatility hivelist -f /home/morgan/Memory\ Images/PhysicalMemory.bin -o 0xac9f008 Address Name 0xe6348910 \Documents and Settings\144553\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 0xebe6e508 \Documents and Settings\144553\NTUSER.DAT 0xe8287508 \WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 0xe1895520 \Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 0xe1882b60 \Documents and Settings\LocalService\NTUSER.DAT 0xe1396008 \Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 0xe139ab60 \Documents and Settings\NetworkService\NTUSER.DAT 0xe4f8eb60 \WINDOWS\system32\config\SAM 0xe77b9b60 \WINDOWS\system32\config\SECURITY 0xe77cd008 \WINDOWS\system32\config\SOFTWARE 0xe77ca418 \WINDOWS\system32\config\DEFAULT 0xe18b6008 [no name] 0xe1035b60 \WINDOWS\system32\config\SYSTEM 0xe102e008 [no name] morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$ ./volatility printkey -f /home/morgan/Memory\ Images/PhysicalMemory.bin -o 0xe1035b60 Key name: [9252] (Stable) Last updated: Wed Jul 29 02:08:26 2009 Subkeys: Traceback (most recent call last): File "./volatility", line 219, in <module> main() File "./volatility", line 215, in main command.execute() File "memory_plugins/registry/printkey.py", line 97, in execute for s in subkeys(key): File "/digitalforensics/Volatility-1.3_Beta/forensics/win32/rawreg.py", line 144, in subkeys s.is_valid() and s.Signature == NK_SIG] AttributeError: 'int' object has no attribute 'is_valid' morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$ ./volatility ident -f /home/morgan/Memory\ Images/PhysicalMemory.bin Image Name: /home/morgan/Memory Images/PhysicalMemory.bin Image Type: Service Pack 3 VM Type: pae DTB: 0x33e000 Datetime: Tue Aug 04 11:02:35 2009

16 years, 3 months

4
10
0 0

Need help: Can anyone provide information about plug-ins for volatility framework, especially used for Linux

by yuhang gao

Dear developers, I would like to work on the memory forensics of Linux and I know many researchers have written plug-ins for volatility framework. I 'd appreciate anyone who provides me with information about them, especially plug-ins for Linux. I am going to write some ones, so your kindness would help me save a lot of time. Thanks a lot. Yuhang Gao

16 years, 4 months

4
7
0 0

Need help with error when using dmp2raw

by Adrian Sanabria

When running dmp2raw on a small (256MB) Windows crash dump, I get the following: Traceback (most recent call last): | Time Remaining: --:--:-- File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "/root/memory_analysis/Volatility-1.3_Beta/vmodules.py", line 62, in execute self.cmd_execute(module, args) File "/root/memory_analysis/Volatility-1.3_Beta/vmodules.py", line 1746, in dmp2raw crash_to_dd(flat_address_space, types, opts.outfile) File "/root/memory_analysis/Volatility-1.3_Beta/forensics/win32/crashdump.py", line 721, in crash_to_dd for j in xrange(0, PageCount*0x1000, 0x1000): OverflowError: long int too large to convert to int dmpchk gives me the following info about this file: DUMP_HEADER32: MajorVersion 0x0000000f MinorVersion 0x00001772 KdSecondaryVersion 0x00000041 DirectoryTableBase 0x00122000 PfnDataBase 0x83200000 PsLoadedModuleList 0x81f5fc70 PsActiveProcessHead 0x81f55990 MachineImageType 0x0000014c NumberProcessors 0x00000002 BugCheckCode 0x0000007f PaeEnabled 0x00000001 KdDebuggerDataBlock 0x81f3fc98 ProductType 0x00000001 SuiteMask 0x00000110 WriterStatus 0x45474150 Physical Memory Description: Number of runs: 2 FileOffset Start Address Length 00001000 00001000 0009a000 0009b000 00100000 dcf4d000 dcfe7000 dd04c000 Any idea what the problem might be?

16 years, 4 months

1
0
0 0

Re: [Vol-users] Need help: Can anyone provide information about plug-ins for volatility framework, especially used for Linux

by Jamie Levy

Hi Yuhang, Welcome to the Volatility users list! While you have been pointed to a wiki of all publicly maintained plugins, some of the Linux code may not be so easy to find. The Linux code for the DFRWS 2008 Forensic Challenge is located in the PyFlag repository: http://www.pyflag.net/pyflag/src/plugins/MemoryForensics/Volatility-1.3_Lin… Further details are available here: http://volatilesystems.blogspot.com/2008/07/linux-memory-analysis-one-of-ma… Some Linux code has been pulled into the 1.4_beta1 branch of the Volatility SVN repository which you can browse at the following: http://code.google.com/p/volatility/source/browse/#svn/branches/Volatility-… or download: svn checkout http://volatility.googlecode.com/svn/branches/Volatility-1.4_beta1/ volatility This branch may not be stable, but you can have a look at the Linux plugins. If you need more help feel free to visit the #volatility channel on freenode (IRC). All the best, -Jamie > Date: Fri, 1 Jan 2010 20:08:32 +0800 > From: yuhang gao <rainman1919(a)gmail.com> > Subject: [Vol-users] Need help: Can anyone provide information about > plug-ins for volatility framework, especially used for Linux > To: vol-users(a)volatilityfoundation.org > > Dear developers, > I would like to work on the memory forensics of Linux and I know many > researchers > have written plug-ins for volatility framework. I 'd appreciate anyone > who provides me with > information about them, especially plug-ins for Linux. I am going to > write some ones, > so your kindness would help me save a lot of time. > Thanks a lot. > Yuhang Gao

16 years, 4 months

3
2
0 0

line 108

by zahra zohoor

Hi I have installed Windows XP SP3. I have got an image with Windd and have installed Python 3.1 I used the following command: python volatility pslist -f memory.dd I get this error: File "volatility" , line 108 print "\tSupported Commands:" SyntaxError: invalid syntax Please please help me...this means so much to me Best Regards Zahra

16 years, 5 months

2
1
0 0

Doubt on a new project

by Rodrigo Albernaz

Hi all, I am new on the list. I am trying to develop a project for a master in computer engineering about volatile memory. Can you help me with some ideas ? What is being research on this kind of assumption ? Where I find what have been developed and what's not ? Thanks attention. Rodrigo

16 years, 5 months

1
0
0 0

Extracting commands

by Jesse Lands

I'm wondering if there is a plugin/command to extract commands that have been run in the past via RDP/telnet etc...I have taken a look at few things, but usually I would look in the csrss.exe process dump. However, we went to an overall memory dump recently and it makes it a little more difficult to parse through. Thanks for any input Jesse

16 years, 5 months

1
0
0 0

hibernation files

by Matthew Donovan

On this mailing list there was some discussion about hibernation files with the first page (0x1000 bytes) zeroed out. The SVN version of hibinfo converts one of these "inactive" hibernation files into a raw dd-type image. But that seems to be all the support it currently has. As an experiment, we changed is_hiberfil() to always return True and ran the Volatility commands on an inactive hibernation file. They all appear to run successfully. So this leads to a few questions: 1) Was that just a fluke of the file we used that the Volatility commands worked? 2) Are there any plans to identify/support hibernation files with the first page zeroed out? 3) Can we assume that a file with the first 0x1000 bytes zeroed out is a hibernation file? 4) If the answer to (2) is 'no' and the answer to (3) is 'yes', where can we submit a patch? Thanks -matthew

16 years, 6 months

3
3
0 0

OMFW 2010!

by AAron Walters

After the amazing success of OMFW 2008 and a little hiatus in 2009, we are currently in the process of planning OMFW 2010. If you are interested in getting involved or have an exciting topic you would like to present, please let the team know. For those who want to attend, please be sure to stay tuned for registration details. Due to the overwhelming response in 2008, we were not able to fulfill all the registration requests, so please be sure to register early! There will be a number of surprises and I guarantee it will be an event you won't want to miss! Links from OMFW 2008: https://www.volatilityfoundation.org/default/omfw http://volatilesystems.blogspot.com/2008/08/open-memory-forensics-workshop-… http://isc.sans.org/diary.html?storyid=4895 http://taosecurity.blogspot.com/2008/08/thoughts-on-omfw-and-dfrws-2008.html AW

16 years, 7 months

1
0
0 0

hibinfo script

by Mark Morgan

I have a hiberfil.sys file from a windows xp sp3 machine and I am trying to convert it to dd using the hibinfo script in volatility. I keep getting an error half through the script as follows: $ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\ Morgan/My\ Doc uments/Hiberfil\ Test/hiberfil.sys -d /c/Documents\ and\ Settings/Mark\ Morgan/ My\ Documents/Hiberfil\ Test/hiber.dd Signature: SystemTime: Thu Jan 01 00:00:00 1970 Control registers flags CR0: 80010031 CR0[PAGING]: 1 CR3: 0afc0080 CR4: 000006f1 CR4[PSE]: 1 CR4[PAE]: 1 Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo (major,minor,build) = hiberAS.get_version() File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py", line 452, in get_version addr_space = IA32PagedMemoryPae(self,self.CR3) NameError: global name 'IA32PagedMemoryPae' is not defined I am wondering if it is because this is a sp3 box??? Any help would be appreciated. Mark Morgan 702-942-2556

16 years, 7 months

2
2
0 0

Re: [Vol-users] hibinfo script

by Richard Gilleland

Mark, Let me know if you figure it out. I just tried the same command and received the following error; ====================================================================== C:\Python25>python \Volatility3\volatility hibinfo -f c:\hiberfil_test\hiberfil.sys -d c:\hibertest.dd Signature: SystemTime: Thu Jan 01 00:00:00 1970 Control registers flags CR0: 00010000 CR0[PAGING]: 0 CR3: 7aed0001 CR4: 00010000 CR4[PSE]: 0 CR4[PAE]: 0 Traceback (most recent call last): File "\Volatility3\volatility", line 219, in <module> main() File "\Volatility3\volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "C:\Volatility3\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "C:\Volatility3\vmodules.py", line 1677, in hibinfo (major,minor,build) = hiberAS.get_version() File "C:\Volatility3\forensics\win32\hiber_addrspace.py", line 467, in get_version ['_KGDTENTRY','BaseLow'], NtTibAddr) File "C:\Volatility3\forensics\object.py", line 206, in read_obj return read_value(addr_space, current_type, vaddr + offset) File "C:\Volatility3\forensics\object.py", line 71, in read_value buf = addr_space.read(vaddr, type_size) File "C:\Volatility3\forensics\x86.py", line 124, in read paddr = self.vtop(vaddr) File "C:\Volatility3\forensics\x86.py", line 109, in vtop if self.entry_present(pgd): File "C:\Volatility3\forensics\x86.py", line 72, in entry_present if (entry & (0x00000001)) == 0x00000001: TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' ================================================================== Detective Ritch Gilleland, EnCE, CCI Sacramento Police Department Office: 916-808-0564 RGilleland(a)pd.cityofsacramento.org >>> Mark Morgan <mark.morgan47(a)gmail.com> 10/06/09 9:48 AM >>> I have a hiberfil.sys file from a windows xp sp3 machine and I am trying to convert it to dd using the hibinfo script in volatility. I keep getting an error half through the script as follows: $ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\ Morgan/My\ Doc uments/Hiberfil\ Test/hiberfil.sys -d /c/Documents\ and\ Settings/Mark\ Morgan/ My\ Documents/Hiberfil\ Test/hiber.dd Signature: SystemTime: Thu Jan 01 00:00:00 1970 Control registers flags CR0: 80010031 CR0[PAGING]: 1 CR3: 0afc0080 CR4: 000006f1 CR4[PSE]: 1 CR4[PAE]: 1 Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo (major,minor,build) = hiberAS.get_version() File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py", line 452, in get_version addr_space = IA32PagedMemoryPae(self,self.CR3) NameError: global name 'IA32PagedMemoryPae' is not defined I am wondering if it is because this is a sp3 box??? Any help would be appreciated. Mark Morgan 702-942-2556

16 years, 7 months

3
2
0 0

Re: [Vol-users] hibinfo script

by Andreas Schuster

I'm sorry, that by far exceeds my knowledge about the hibernate stuff. I don't even have a suitable file for testing on stock. Could someone else please look into this? Thanks, Andreas Mark Morgan: > Andreas, > > Thanks for the quick reply. I changed the line as requested and here > is the error I get: > > $ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\ > Morgan/My\ Doc > uments/sandman/hiberfil.sys -d hiber.dd > Signature: > SystemTime: Thu Jan 01 00:00:00 1970 > > Control registers flags > CR0: 80010031 > CR0[PAGING]: 1 > CR3: 0afc0080 > CR4: 000006f1 > CR4[PSE]: 1 > CR4[PAE]: 1 > Traceback (most recent call last): > File "volatility", line 219, in <module> > main() > File "volatility", line 212, in main > modules[argv[1]].execute(argv[1], argv[2:]) > File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute > self.cmd_execute(module, args) > File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo > (major,minor,build) = hiberAS.get_version() > File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py", > line 467, in > get_version > ['_KGDTENTRY','BaseLow'], NtTibAddr) > File "c:\Volatility-1.3_Beta\forensics\object.py", line 246, in > read_obj > return read_value(addr_space, current_type, vaddr + offset) > File "c:\Volatility-1.3_Beta\forensics\object.py", line 71, in > read_value > buf = addr_space.read(vaddr, type_size) > File "c:\Volatility-1.3_Beta\forensics\x86.py", line 313, in read > paddr = self.vtop(vaddr) > File "c:\Volatility-1.3_Beta\forensics\x86.py", line 294, in vtop > if not self.entry_present(pdpe): > File "c:\Volatility-1.3_Beta\forensics\x86.py", line 239, in > entry_present > if (entry & (0x00000001)) == 0x00000001: > TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' > > And here is the portion of the hiber_addrspace.py that I changed: > > from forensics.addrspace import FileAddressSpace > import forensics.x86 > from forensics.object import * > from forensics.win32.xpress import xpress_decode > from thirdparty.progressbar import * > from forensics.win32.datetime import * > from vtypes import xpsp2types as types > from forensics.x86 import IA32PagedMemory,IA32PagedMemoryPae > > > Mark Morgan > > On Tue, Oct 6, 2009 at 11:06 AM, Andreas Schuster > <a.schuster(a)yendor.net> wrote: > Mark, > > Thank you for your bug report. > > > CR4[PAE]: 1 > > > File "c:\Volatility-1.3_Beta\forensics\win32 > \hiber_addrspace.py", > > line 452, in > > get_version > > addr_space = IA32PagedMemoryPae(self,self.CR3) > > NameError: global name 'IA32PagedMemoryPae' is not defined > > > I am wondering if it is because this is a sp3 box??? Any > help would > > be appreciated. > > > No, it happens because the system was in PAE mode (CR4[PAE]: > 1), but the > programmer forgot to import the PAE address space. > > Please edit forensics/win32/hiber_addrspace.py, line 43, to > become: > from forensics.x86 import IA32PagedMemory, IA32PagedMemoryPae > > Please let us know if this fixes the problem. > > Thanks! > Andreas > >

16 years, 7 months

2
1
0 0

Help with ModDump

by Mark Morgan

I am using WIN XP SP 2, python 2.6.2 and the 1.3 beta of volatility. I can get all the scripts to work just fine except those that require a dump. I am trying to dump the mods out of memory using the following syntax: python volatility moddump -f /c/memory.img > /f/dumps I have also tried with the backslash and forward slash but I either get the error: "File exists" or "Access Denied" Any help would be appreciated. Mark Morgan DOE/CIRC Las Vegas, NV

16 years, 9 months

5
4
0 0

New and Updated Volatility Plug-ins

by AAron Walters

http://mnin.blogspot.com/2009/07/new-and-updated-volatility-plug-ins.html Volatility contributor Michael Hale Ligh has recently released a number of new and updated plugins. * idt.py: printing the Interrupt Descriptor Table (IDT) addresses * driverirp.py: printing driver IRP function addresses * usermode_hooks2.py: updated usermode hook detection plug-in * kernel_hooks.py: detects IAT, EAT, and in-line hooks in kernel drivers * orphan_threads.py: detects hidden system/kernel threads * malfind2.py: updated plugin for detecting hidden/injected code in usermode processes His blog post also demonstrates how each plugin can be useful for detecting different types of malware. Please take some time to test these plugins and send Michael any feedback you may have. Shouts to MHL for his contributions to the Volatility community! Thanks, AW

16 years, 10 months

1
0
0 0

Unexplained Errors

by Robert Miller

Hello Everyone, I have been dumping memory on a few systems and when I go to process the memory images I get different errors, some of these I think I've found the answers but not sure on others. Here are the errors I have seen: procdump: ======= Memory Not Accessible: Virtual Address: 0x4ad50000 File Offset: 0x50000 Size: 0x1000 pslist: ==== volatility_v1.3/forensics/win32/crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import sha *** Unable to load module malfind: No module named pydasm *** Unable to load module malfind: No module named pydasm datetime: ====== /volatility_v1.3/forensics/win32/crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import sha *** Unable to load module malfind: No module named pydasm *** Unable to load module malfind: No module named pydasm I believe the DeprecationWarning is due to the version of Python, which is 2.6.2 The malfind module, not sure why I downloaded the module and have not looked into it, however there should not be an issue, but there is. Any Advice? Thanks, Robert

16 years, 10 months

2
1
0 0

decompression of hyberfil.sys

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello all, I have posted this twice because the decompression issue should be moved to vol-dev as Aaron suggested. yesterday Andreas did provide a hiberfil.sys for decompression testing. Thanks a lot again. I have processed it twice with X-Ways-Forensics 15.3 SR3 and Volatility (SVN-release). The good news: Both result files are identical. The bad news: I dont have any clue why the decompression of my case relevant hiberfil.sys did not properly work with volatility but did with XWF. If anyone other needs a hiberfil.sys decompressed with XWF for testing, do not hesitate to ask me. We have the most recent releases here. (I am back on the 29th of July) I did compare the vol and the XWF-version of my case files but I cant interpret or explain the differences. What should I look for? BR Michael Michael Felber, StA Finanzamt Chemnitz-Süd Steuerfahndung IT-Forensik Paul-Bertz-Str. 1 D-09120 Chemnitz Germany Fon: +49 371 279 446 Fax. +49 371 279 421

16 years, 10 months

1
0
0 0

Re: [Vol-users] Volatility Call for Bugs

by Andreas Schuster

All, Maybe I can help with the test case. I could reactivate the VM that I created to research the non-paged pool persistence about a year ago. It's a clean install of Windows XP, 32 bit, Service Pack 2, and only a few background services running. What are your opinions on the following test plan: 1. start VM, boot Windows 2. enable hibernation 3. suspend VM 4. copy VMEM to prehib.vmem 5. resume VM 6. cause system to hibernate, VM stops 7. map system disk 8. copy hiberfil.sys 9. unmap system disk 10. start VM, resume Windows 11. suspend VM 12. copy VMEM to posthib.vmem 13. Compare prehib.vmem and posthib.vmem page by page (assuming a page size of 4kiB, and neglecting large pages here). Assume, that identical pages also were unchanged at time of hibernation. 14. Process hiberfil.sys by tool of choice. Verify, that unchanged pages (step 13) match. This would give us a first estimate of quality. A thorough test would require a hiberfil.sys that has been constructed such that every possible code path (in the original algorithm) is executed at least once. But, unfortunately, that exceeds my abilities. Cheers, Andreas

16 years, 10 months

2
1
0 0

Volatility Call for Bugs

by AAron Walters

Jesse Kornblum, our favorite geek raised by wolves, has graciously agreed to help prepare the next release of Volatility. Please take some time and report any bugs you may have encountered. It's great to see people willing to step up and contribute back to the community! Remember, Volatility is powered by the people! If you are waiting for something to get worked on, it will get done a lot faster the more you are willing to contribute. Shouts to Jesse! http://jessekornblum.livejournal.com/253092.html Thanks, AW

16 years, 10 months

2
2
0 0

Analyzing a hiberfil.sys

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello folks, I am new to volatility but used it successfully several times. Thank to all contributors. Today I wanted to analyze some hibernation files with it but had no success: python volatility hibinfo -f "G:\X-Ways-Images\##bad guy##\RAM-Analyse\hiberfil-NB-###-ohne-Slack.sys" -d "g:\X-Ways-Images\##bad guy##\RAM-Analyse\hiberfil-NB-###-ohne-Slack-decom-vola.sys" C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import sha Signature: SystemTime: Thu Jan 01 00:00:00 1970 Control registers flags CR0: 80010031 CR0[PAGING]: 1 CR3: 0a338080 CR4: 000006f9 CR4[PSE]: 1 CR4[PAE]: 1 Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 212, in main modules[argv[1]].execute(argv[1], argv[2:]) File "C:\Micha\Forensics\Volatility\vmodules.py", line 62, in execute self.cmd_execute(module, args) File "C:\Micha\Forensics\Volatility\vmodules.py", line 1677, in hibinfo (major,minor,build) = hiberAS.get_version() File "C:\Micha\Forensics\Volatility\forensics\win32\hiber_addrspace.py", line 452, in get_version addr_space = IA32PagedMemoryPae(self,self.CR3) NameError: global name 'IA32PagedMemoryPae' is not defined The OS to be analyzed is WinXP SP 2. I used X-Ways-Forensics to cut the slack of the hiberfil.sys off. XWF did successfully decompress the so cutted file and interpret it as a virtual RAM-filesystem. I had more than one hiberfil to look at but non did work with volatility hibinfo. Has anyone made experiences with that? Any help appreciated. Regards Michael Felber Special agent Germany

16 years, 10 months

3
3
0 0

AW: AW: Analyzing a Hiberfil.sys

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello Brendan, hello all thanks a lot for the carefree-all-around zip package. It works fine. The hiberfil.sys gets decompressed now. Thanks a lot to all other for their useful hints. I have processed a "shortened" version of the original file without the hiberfil-slack. Now both programs (vol and WinHex) did decompress the file BUT: The files have the same length but different md-5-sums because of 'some' binary differences. At the moment I don't know, which version is the 'right'. Both mapped with X-Ways Forensics generated the following results: WinHex-version: totally 1.465 objects, Volatility-version: 1.363 objects I have compared the results and found, that some minor objects in the xwf-version are duped but some objects are not found in the vol-version. I have attached a list of the "missed" objects, quick and dirty, simply sorted by name. Maybe someone has a clue what may have caused this difference. Currently I try to find a way to compare extracted objects by vol and XWF. BR Michael @Andreas: Thanks for the offer to call you, will do that but need your "Telefonnummer"... -----Ursprüngliche Nachricht----- Von: Dolan-gavitt, Brendan F [mailto:brendandg@gatech.edu] Gesendet: Donnerstag, 2. Juli 2009 20:20 An: AAron Walters Cc: Michael Felber , Steufa Chemnitz, IT-Forensik Betreff: Re: AW: Analyzing a Hiberfil.sys I did indeed--you can get it here: http://amnesia.gtisc.gatech.edu/~moyix/Volatility-SVN.zip -Brendan ----- Original Message ----- From: "AAron Walters" <awalters(a)4tphi.net> To: "Michael Felber , Steufa Chemnitz, IT-Forensik" <MichaelFelber(a)gmx.net> Cc: brendandg(a)gatech.edu Sent: Thursday, July 2, 2009 11:13:55 AM GMT -05:00 US/Canada Eastern Subject: Re: AW: Analyzing a Hiberfil.sys Michael, You will need to check out the entire repository. At one point, Brendan created a zip file. Thanks, AW On Thu, 2 Jul 2009, Michael Felber , Steufa Chemnitz, IT-Forensik wrote: > Hello Aaron, > > have downloaded most of the new files but got volatility crashed with that. > I assume I have to download ALL the new released files manually an copy them > to their destination? Or is there a new complete package available? > > Cu > > Michael > > -----Ursprüngliche Nachricht----- > Von: AAron Walters [mailto:awalters@4tphi.net] > Gesendet: Donnerstag, 2. Juli 2009 16:22 > An: Michael Felber , Steufa Chemnitz, IT-Forensik > Cc: brendandg(a)gatech.edu > Betreff: Re: Analyzing a Hiberfil.sys > > > > Michael, > > Thanks for the email. I'm glad you have found Volatility useful. You may > want to check out the latest version from the svn repository which > includes a number of bug fixes. Let me know if it generates the same > errors. > > http://code.google.com/p/volatility/source/checkout > > Thanks, > > AW > > > On Thu, 2 Jul 2009, Michael Felber , Steufa Chemnitz, IT-Forensik wrote: > >> Hello, >> >> >> >> I am new to volatility but I am very impressed by the capabilities of that >> tool collection. I have already used it in a couple of cases and found >> interesting clues for further investigation more than one time. Thanks a >> lot, great tool. >> >> >> >> I used v 1.3 Beta with Python 2.6.2. to analyze a hiberfil.sys. The try > to >> decompress it produced the following error message: >> >> >> >> C:\Micha\Forensics\Volatility>python volatility hibinfo -f >> "F:\X-Ways-Images\##bad guy##\RAM-Analyse\NB Asus, Partition >> 2\hiberfil-NB-ASUS.sys" –d "hiberfil-NB-ASUS-vol.sys" >> >> C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31: >> DeprecationWarning: the sha module is deprecated; use the hashlib module >> instead >> >> import sha >> >> Signature: >> >> SystemTime: Thu Jan 01 00:00:00 1970 >> >> >> >> Control registers flags >> >> CR0: 000212dd >> >> CR0[PAGING]: 0 >> >> CR3: 0001d69f >> >> CR4: 00020160 >> >> CR4[PSE]: 0 >> >> CR4[PAE]: 1 >> >> Traceback (most recent call last): >> >> File "volatility", line 219, in <module> >> >> main() >> >> File "volatility", line 212, in main >> >> modules[argv[1]].execute(argv[1], argv[2:]) >> >> File "C:\Micha\Forensics\Volatility\vmodules.py", line 62, in execute >> >> self.cmd_execute(module, args) >> >> File "C:\Micha\Forensics\Volatility\vmodules.py", line 1677, in hibinfo >> >> (major,minor,build) = hiberAS.get_version() >> >> File "C:\Micha\Forensics\Volatility\forensics\win32\hiber_addrspace.py", >> line 452, in get_version >> >> addr_space = IA32PagedMemoryPae(self,self.CR3) >> >> NameError: global name 'IA32PagedMemoryPae' is not defined >> >> >> >> Options –q, -t pae|nopae did not help. >> >> >> >> What went wrong? >> >> >> >> Kindest regards >> >> >> >> Michael Felber >> >> Agent in charge >> >> >> >> Michael Felber, StA >> >> Finanzamt Chemnitz-Süd >> >> Steuerfahndung >> >> IT-Forensik >> >> Paul-Bertz-Str. 1 >> >> D-09120 Chemnitz >> >> Germany >> >> >> >> Fon: +49 371 279 446 >> >> Fax. +49 371 279 421 >> >> >> >> >:

16 years, 10 months

1
0
0 0

Re: [Vol-users] Analyzing a hiberfil.sys

by Matthieu Suiche

Agreed with Andreas. The first page is propably empty. I dont have the last version of XWays. Anyway, Ill release in the following months a package of useful tools for file conversion. Including a hibr2bin.exe tool with Windows 2000 support. Kind Regards, -- Matthieu Suiche On Thu, Jul 2, 2009 at 5:14 PM, Andreas Schuster<a.schuster(a)yendor.net> wrote: > Hello Michael, > >> Signature: > > I'd expect to see "hibr" here. Please check whether the file starts with the > proper magic string. Or did you already decompress the file? If so, then > please either decompress the original file using "hibinfo" or try "ident" on > the existing one. > > Regarding Matthieu's post: As far as I know, X-Ways switched to a different > implementation of the decompression algorithm after my blog post appeared. I > *think* it works as expected, but as a customer you may want to ask them for > their (internal) test results and methodology, just to be sure. > > I'll be back to my office on Tuesday. Feel free to give me a call if the > problem persists. > > Viele Gruesse, > Andreas > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >

16 years, 10 months

1
0
0 0

Volatility Plug-in for IAT/EAT/Inline Hook Detection

by AAron Walters

http://mnin.blogspot.com/2009/05/volatility-plug-in-for-iateatinline.html Michael Hale Ligh has created another new Volatility plugin for malware analysts. This plug-in called usermode_hooks.py can be used to detect IAT/EAT/Inline rootkit hooks in usermode processes. I'm sure he would appreciate testing help and any feedback you are able to provide. Shouts to MHL! Thanks, AW

16 years, 11 months

1
0
0 0

Re: [Vol-users] Volatility's Network Connections

by david＠sharpebusinesssolutions.com

I concur with your point about needing to use all three tools. Each has its own strengths and weaknesses. I use HBGary Responder Pro primarily and fall over to Volatility or Mandiant Memoryze when I come across something HBGary can't do (or I don't know how to do in HBGary). To your point about analyzing network connections, I have recently observed cases where Volatility "connections" produces no output at all and HBGary does. In that situation Volatility "connscan" does find connections, but the lists doesn't 100% match HBGary. I am also a little concerned about what appears to me to be a drop in development activity around Volatility. Is Mandiant Memoryze going to take over the top slot? Right now, I see Mandiant Memoryze as third best behind HBGary and Volatility, but Volatility can't stand still. For example, does anyone know if there any plans to provide functionaility similar to HBGary's new Digital DNA in Volatility? If anyone wants to share information or experiences across all three applications or memory dump analysis in general, feel free to contact me at david(a)sharpebusinesssolutions.com. -- David --- cutaway(a)cutawaysecurity.com wrote: From: "Don C. Weber" <cutaway(a)cutawaysecurity.com> To: vol-users(a)volatilesystems.com Subject: [Vol-users] Volatility's Network Connections Date: Wed, 6 May 2009 08:48:47 -0500 I wanted to let you know that while using Volatility and several other memory analysis tools I received some conflicting information associated with network connections. I did a quick blog post on the subject that can be read here: http://www.cutawaysecurity.com/blog/archives/523 . It looks like Volatility shows more information than the others in some instances. Also, if you have additional information or detail on this please post a comment or let me know so that I can add an update to the post. -- -------------------------- Don C. Weber Information Security Consultant Cutaway Security CISSP, GIAC ######################################### Website: http://www.cutawaysecurity.com _______________________________________________ Vol-users mailing list Vol-users(a)volatilesystems.com http://lists.volatilesystems.com/mailman/listinfo/vol-users

17 years

7
6
0 0

Re: [Vol-users] Volatility's Network Connections

by david＠sharpebusinesssolutions.com

The Volatility connscan and connscan2 output are identical byte-for-byte against the dump I am talking about. "Connections" terminates gracefully with no console output in tcb_connections in network.py after having trouble locating the right data structure to walk in my dump file. Thank you for taking the time to respond. I wasn't really asking for help with anything in my initial reply to this thread. I was just trying to support the original author's assertion that there are differences between the various commercial and non-commercial solutions in the Windows memory dump analysis space. In my view, all three that I personally have experience with so far: Volatility, HBGary Responder, and Mandiant Memoryze all have their own strengths and weaknesses. I see this space just like hard drive or mobile device forensics - each of the leading vendors has their strong points and sometimes you need to combine the results of multiple tools to get the best results. -- David --- taosecurity(a)gmail.com wrote: From: Richard Bejtlich <taosecurity(a)gmail.com> To: david(a)sharpebusinesssolutions.com Cc: "Don C. Weber" <cutaway(a)cutawaysecurity.com>, vol-users(a)volatilesystems.com Subject: Re: [Vol-users] Volatility's Network Connections Date: Mon, 11 May 2009 10:15:48 -0400 On Thu, May 7, 2009 at 10:12 AM, <david(a)sharpebusinesssolutions.com> wrote: > > > I concur with your point about needing to use all three tools. Each has its own strengths and weaknesses. I use HBGary Responder Pro primarily and fall over to Volatility or Mandiant Memoryze when I come across something HBGary can't do (or I don't know how to do in HBGary). > > To your point about analyzing network connections, I have recently observed cases where Volatility "connections" produces no output at all and HBGary does. In that situation Volatility "connscan" does find connections, but the lists doesn't 100% match HBGary. > Hi David, When you say "connscan", have you also used "connscan2"? Thank you, Richard _______________________________________________ Vol-users mailing list Vol-users(a)volatilesystems.com http://lists.volatilesystems.com/mailman/listinfo/vol-users

17 years

1
0
0 0

Volatility's Network Connections

by Don C. Weber

I wanted to let you know that while using Volatility and several other memory analysis tools I received some conflicting information associated with network connections. I did a quick blog post on the subject that can be read here: http://www.cutawaysecurity.com/blog/archives/523 . It looks like Volatility shows more information than the others in some instances. Also, if you have additional information or detail on this please post a comment or let me know so that I can add an update to the post. -- -------------------------- Don C. Weber Information Security Consultant Cutaway Security CISSP, GIAC ######################################### Website: http://www.cutawaysecurity.com

17 years

2
2
0 0

Acquiring data and support for Win2k3.

by Richard Miles

Hello volatile users, It's my first post, I'm not in the forensics Industry, I'm more like a curious... I'm very impressed with volatile system. Amazing project. Someone know if there any any plan to add support to Windows 2003 in Volatility? It should be awesome. Speaking a bit about acquiring data. I use mdd in general. However I always only copy a small amount of ram (256 mb in average), because try copy the whole system memory result in crashes. There is anyway to copy most data as possible without disrupt windows? In general, how do you deal with this problem? Thank you. R.

17 years, 1 month

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-users