Does Volatility support the analysis of Mac /var/vm/sleepimage?
I did not see it mentioned in "The Art of Memory Forensics", and I
seem to have trouble even doing a simple mac_pslist against it...
--
Jarle Thorsen
vol-users,
The registration for the Open Memory Forensics Workshop (OMFW) 2014 closes
on Oct 24. If you are still planning to attend, I recommend sending a
request as soon as possible. There are less than 10 open seats remaining!
For those who have already requested an invitation, please let us know if
you have not received your registration details.
Reserve your seat by sending an email to info [at]
volatilityfoundation.org or using the contact form on the Foundation's
website.
Thanks,
The Volatility Foundation
www.volatilityfoundation.org
We are excited to announce that we now have public trainings scheduled
through May of next year. Between now and then we will be visiting
Austin (Dec.), San Francisco (Jan.), Brazil (Feb.), Reston, VA (April),
and New York (May). A complete listing of course offerings and details
can be found at:
http://www.memoryanalysis.net/#!memory-forensics-training/c1q3n
and:
http://volatility-labs.blogspot.com/2014/10/windows-malware-and-memory-fore…
Classes fill quickly so please contact us ASAP if you would like to
attend! We offer discounts for LEO, government, and full time students
as well as group rates for companies.
--
Thanks,
Andrew (@attrc)
Hi all,
I have acquired an android RAM image by using Lime and now I am using
volatility to analyze it. I have created a profile and can now list
processes, etc. What I need to do is inspect an integer array of a kernel
module, which I have the address. I tried using volshell's dd() but I
believe it is not showing the correct values. How can I certify that the
virtual address is being calculated correctly by volatility?
Thanks in advance,
Felipe
I have a .vmem file from a Mac OS virtual machine. I'm using profile
"MacMountainLion_10_8_2_AMDx64"
Using Volatility 2.4, I'm able to run a few mac commands against this
image, however I get traceback errors in the 'netstat' and 'arp' commands.
I paste below:
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_ifconfig
Volatility Foundation Volatility Framework 2.4
Interface Address
---------- -------
lo0 fe80:1::1
lo0 127.0.0.1
lo0 ::1
gif0
stf0
en0 00:0c:29:ea:9a:27
en0 fe80:4::20c:29ff:feea:9a27
en0 172.16.253.140
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_version
Volatility Foundation Volatility Framework 2.4
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012;
root:xnu-2050.18.24~1/RELEASE_X86_64
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_netstat
Volatility Foundation Volatility Framework 2.4
Proto Local IP Local Port Remote IP Remote Port
State Process
------ -------------------- ---------- -------------------- -----------
-------------------- ------------------------
UNIX -
UNIX /var/tmp/launchd/sock
UNIX -
UNIX /var/run/com.apple.ActivityMonitor.socket
UNIX /var/run/mDNSResponder
UNIX /var/rpc/ncacn_np/lsarpc
UNIX /var/rpc/ncalrpc/lsarpc
UNIX /var/rpc/ncacn_np/mdssvc
UNIX /var/rpc/ncalrpc/NETLOGON
UNIX /var/rpc/ncacn_np/srvsvc
UNIX /var/rpc/ncalrpc/srvsvc
UNIX /var/rpc/ncacn_np/wkssvc
UNIX /var/rpc/ncalrpc/wkssvc
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in
<module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py",
line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py",
line 127, in execute
func(outfd, data)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/netstat.py",
line 58, in render_text
self.table_row(outfd, proto, lip, lport, rip, rport, state,
"{}/{}".format(proc.p_comm, proc.p_pid))
ValueError: zero length field name in format
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_arp
Volatility Foundation Volatility Framework 2.4
Source IP Dest. IP Name Sent
Recv Time Exp. Delta
------------------------ ------------------------ ----------
------------------ ------------------ ------------------------------
---------- -----
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in
<module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py",
line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py",
line 127, in execute
func(outfd, data)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/route.py",
line 104, in render_text
rt.name,
File "/home/forensics/programs/volatility-2.4/volatility/obj.py", line
537, in __getattr__
return getattr(result, attr)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/overlays/mac/mac.py",
line 562, in name
return "{}{}".format(self.rt_ifp.if_name.dereference(),
self.rt_ifp.if_unit)
ValueError: zero length field name in format
++++++++++++++++++++++++++++++
Any thoughts or ideas are very appreciated!
--
Andre' M. DiMino
DeepEnd Research
http://deependresearch.orghttp://sempersecurus.org
"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)
I just build a VM with Debian (I needed to install other packages) and when I run this on a memory image I get the following (after about 10 minutes). The pslist.txt file is partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py", line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
Hi, everybody,
I'm a new comer to volatility framework. At the same time, I am getting to work with libvirt library. I created a dump file named 'vm1_snapshot' by using libvirt command like 'virsh save domain'. In the domain ran the WinXPSP3x86. However, when I used 'python vol.py -f ~/vm1_snapshot --profile=WinXPSP3x86 pslist', the result showed as 'No suitable address space mapping found'. How could this happen? Is there anything wrong with the way the snapshot file was created? I hope some guy can do me a favor.
Testing zeusscan against a known zeus vmem sample, I am getting a
segmentation fault. Other vol commands run and return results properly, and
zeuscan appears to have compiled OK. No errors output except for the
segmentation fault.
Host OS is CentOS Linux 2.6, Volatility is 2.4. Zeus.vmem is WinXPSP2x86
Any ideas on troubleshooting?
Bill
