- Vol-dev - volatilityfoundation.org

Three 2014 Volatility & Memory Forensics trainings are now scheduled

by Andrew Case

As we previously sent to the list, the Volatility team will be holding training sessions in San Diego in January and London in June: http://volatility-labs.blogspot.com/2013/09/2014-malware-and-memory-forensi… We have now also finalized plans for a training in NYC in May: http://volatility-labs.blogspot.com/2013/10/2014-malware-and-memory-forensi… These will be the only public trainings through August of next year, and we have already received substantial interest in each one. If you plan to attend do not wait until the last minute to contact us as for our last several trainings we have had to turn away people once the classroom fills. If your company is interested in a private training or hosting a public training in exchange for a few free seats then please let us know ASAP as these opportunities for 2014 will likely be taken by other companies over the next month or two. Finally, the Volatility team would like to thank everyone who came out to OMFW and to those of you who attended our OSDFC talk and showed support for the project. Over the next couple weeks we will be sending out slides and updates from OMFW, and please reach out to us if you have questions for any of the speakers that you did not get to ask in person. Thanks, Andrew (@attrc)

11 years

1
0
0 0

New plugins: Filelist and Virustotal

by Sebastien Bourdon-Richard

Hi, Based on the work AAron and the Volatility team have done for the dumpfiles plugin (thanks for the plugin btw), I have wrote two new plugins for Volatility. I have coded those plugins to learn more about the new dumpfiles plugin. I'm sharing them hoping they will be useful for someone else. The first plugin is filelist. It is used to list files that can be extracted by the dumpfiles plugin. The second plugin is virustotal and it is used to query/submit cached memory files to virustotal. Both plugins can be downloaded here [1]. Here's some examples on how to use the filelist plugin. Memory sample [2] was used for the examples. List exe files in the memory dump: C:\Volatility>python vol.py -f Bob.vmem filelist -r \.exe Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------- 0x81dd28d0 548 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\smss.exe 0x822741c8 612 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x81d45b00 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x822ec7f8 688 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\services.exe 0x81e5c028 700 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe 0x8226ba70 852 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmacthlp.exe 0x81d476d8 880 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x81d476d8 880 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x822dfbd0 1460 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe 0x82113220 1628 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmtoolsd.exe 0x81d163f8 1836 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe 0x81cf83a0 2024 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\alg.exe 0x81e584c0 1756 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81e584c0 1756 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81ca9028 1108 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x81ca9028 1108 No DataSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x820cdbd8 1116 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareUser.exe 0x820a83a8 1132 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe 0x81cbdd18 244 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x81cbdd18 244 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x820c3298 440 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x820c3298 440 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x81dc2e90 888 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x81dc2e90 888 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x82077868 1752 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe 0x82077868 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe List all files opened by PID 644 (i.e: winlogon.exe with Zeus/Zbot injected): C:\Volatility>python vol.py -f Bob.vmem filelist -p 644 Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ------------------------------------------------------------------------------------- 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81ebe598 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\user.ds 0x822e3ea0 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\local.ds 0x81f14590 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls 0x81ebe028 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls 0x81e4f4b0 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\locale.nls 0x822a4210 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls 0x822da598 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe […] List DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem filelist -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------------------- 0x81c8c8e8 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp 0x8206f028 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp 0x81dfadf0 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php 0x81ec1960 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf 0x81ec8f90 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...Temporary Internet Files\Content.IE5\index.dat 0x820da3d8 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat 0x820da470 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...r\Local Settings\History\History.IE5\index.dat Here's some examples on how to use the virustotal plugin. Please note that Virustotal plugin does not submit any files to VT by default. To use this plugin, edit virustotal.py and enter your VT API Key. By default, the plugin operate in public mode (i.e: maximum 4 requests per minute to VT). However, if you have a private key, it's possible to adjust the delay between queries with the --delay option. Query Virustotal for the file sdra64.exe present in memory: C:\Volatility>python vol.py -f Bob.vmem virustotal -r sdra64\.exe Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe Cache file type: DataSectionObject PID: 644 MD5: b3e40cb29a3125ac862570ed5b5212a5 Detection ratio: 38/41 Analysis date: 2010-05-23 00:22:26 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Trojan.Generic.KD.387 20100522 CAT-QuickHeal Win32.Packed.Krap.ao.4 20100521 McAfee PWS-Zbot.gen.ak 20100523 TheHacker Trojan/Kryptik.cqz 20100522 VirusBuster Trojan.Kryptik.IBE 20100522 NOD32 a variant of Win32/Kryptik.CQZ 20100522 F-Prot W32/Agent.FG.gen!Eldorado 20100523 Symantec Packed.Generic.292 20100522 Norman W32/Zbot.PFX 20100522 TrendMicro-HouseCall TROJ_ZBOT.AZR 20100523 Avast Win32:Crypt-FWN 20100522 eSafe None 20100520 ClamAV Trojan.Zbot-8228 20100522 Kaspersky Packed.Win32.Krap.ao 20100522 BitDefender Trojan.Generic.KD.387 20100523 Comodo TrojWare.Win32.TrojanSpy.Zbot.Gen 20100522 F-Secure Trojan.Generic.KD.387 20100522 DrWeb Trojan.Winlock.1115 20100522 AntiVir TR/Agent.AO.177 20100521 TrendMicro TROJ_ZBOT.AZR 20100522 McAfee-GW-Edition PWS-Zbot.gen.ak 20100522 Sophos Mal/FakeAV-BW 20100522 eTrust-Vet Win32/FakeAV!generic 20100521 Authentium W32/Agent.FG.gen!Eldorado 20100522 Jiangmin Packed.Krap.cfls 20100522 Antiy-AVL Packed/Win32.Krap.gen 20100521 a-squared Packed.Win32.Krap!IK 20100510 Microsoft Trojan:Win32/Malagent 20100522 ViRobot None 20100522 Prevx Medium Risk Malware 20100523 GData Trojan.Generic.KD.387 20100522 AhnLab-V3 Win-Trojan/Burnix.Gen 20100522 VBA32 Trojan.Win32.Inject.anij 20100522 Sunbelt Trojan-Spy.Win32.Zbot.gen (v) 20100522 PCTools HeurEngine.MaliciousPacker 20100522 Rising Trojan.Win32.Generic.51FFF748 20100522 Ikarus Packed.Win32.Krap 20100522 Fortinet None 20100522 AVG Cryptic.BL 20100523 Panda Trj/Krap.Y 20100522 Avast5 Win32:Crypt-FWN 20100522 Query DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem virustotal -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp Cache file type: DataSectionObject PID: 1752 MD5: aeb2581f6c99b4434fb8ed96aeb3e43d Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:31 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp Cache file type: DataSectionObject PID: 1752 MD5: c6ea3ec108b4610831883617dc877f4b Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:05 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 201005 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf Cache file type: DataSectionObject PID: 1752 MD5: cd3c38c9c0e910bf1fe722871039cf3d Detection ratio: 0/42 Analysis date: 2010-04-04 18:36:07 ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 1b6e92d96236f8d2307412283c7666cb File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 7b00dbeb59f8fc8e70f291731bd36811 File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: b995dc0123737ae13a70f71c88657daf File not present on VirusTotal * Query all pdf.php files in memory (ignore case) and upload any file that is unknown to VirusTotal:* C:\Volatility>python vol.py -f Bob.vmem virustotal -r pdf.php -i --submit Volatility Foundation Volatility Framework 2.3 *********************************************************************** File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 20100512 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: SharedCacheMap PID: 1752 MD5: ef6f0c1e573d6fbfa9c5b0d77cfbe2cd File not present on VirusTotal. Uploading file... Scan request successfully queued, come back later for the report Requested item is still queued for analysis...waiting 60 seconds Requested item is still queued for analysis...waiting 60 seconds Detection ratio: 17/40 Analysis date: 2013-10-14 19:35:44 Antivirus Result Update ------------------------- ---------------------------------------- ------------ MicroWorld-eScan Exploit.PDF-Name.Gen 20131014 nProtect Exploit.PDF-Name.Gen 20131014 CAT-QuickHeal None 20131014 McAfee None 20131014 Malwarebytes None 20131014 K7AntiVirus None 20131014 K7GW None 20131014 TheHacker None 20131014 NANO-Antivirus Exploit.Script.Pdfka.lcgj 20131014 F-Prot None 20131014 Symantec Bloodhound.PDF.8 20131014 Norman Obfuscated.JS 20131014 ByteHero None 20130923 Avast JS:Pdfka-gen [Expl] 20131014 ClamAV Heuristics.PDF.ObfuscatedNameObject 20131013 Kaspersky None 20131014 BitDefender Exploit.PDF-Name.Gen 20131012 Agnitum None 20131014 ViRobot None 20131014 Emsisoft Exploit.PDF-Name.Gen (B) 20131014 Comodo None 20131014 DrWeb SCRIPT.Virus 20131014 AntiVir EXP/Pidief.OR 20131014 McAfee-GW-Edition None 20131014 Sophos Mal/PdfEx-C 20131014 Jiangmin None 20131014 Panda None 20131014 Antiy-AVL None 20131014 Kingsoft None 20130829 Microsoft Exploit:Win32/Pdfjsc.EF 20131014 SUPERAntiSpyware None 20131014 GData Exploit.PDF-Name.Gen 20131014 Commtouch PDF/Obfusc.G!Camelot 20131014 TotalDefense None 20131011 VBA32 None 20131014 PCTools HeurEngine.PDF 20131002 ESET-NOD32 None 20131014 Ikarus Exploit.JS.Pdfka 20131014 Fortinet None 20131014 Baidu-International None 20131014 Hope this help! Regards, Sebastien [1]: https://github.com/sebastienbr/Volatility/tree/master/plugins [2]: https://www.honeynet.org/challenges/2010_3_banking_troubles

11 years, 1 month

1
0
0 0

probably a really dump question RE: the new dumpfiles plugin

by McCash John-GKJN37

Hi, I'd been looking forward to the new dumpfiles plugin for a while, so I immediately downloaded it and tried it out as soon as possible after I saw it had finally been committed to the source tree the other day. (I'm freely admitting I'm using the thing without any documentation, since that still hasn't been committed, and probably have no idea what I'm really doing.) Now, I have a dumb question. The names of the dumped files are all of the format: file.<number>.<hex number>.< dat |img |vacb> In addition, the dumping process produces a bunch of output, of the form: <DataSectionObject|ImageSectionObject|SharedCacheMap> <hex number> <number> <file path> with no column header or other indication of what exactly these values refer to. (If I had to guess, maybe the hex value is the data offset within the image?) Looking at this format (without knowing for sure exactly what the numbers are referring to) would lead me to expect that the <number> and <hex number> fields from the output should correspond to the ones in the dumped filenames, and thus the file paths should have some correspondence to the dumped file data, if the values match up. Not necessarily being the contents of exact file to which the path corresponds, but being related in some way. But I'm not seeing the same hex value show up anywhere in the output and in ANY filename... Trying for a specific correspondence, I went looking through the dumped files, and was able to positively identify the Software registry hive. The associated filename was file.4.0x8697a2b8.vacb. Looking through the output for entries associated with this file identified the following two entries: DataSectionObject 0x89291f90 4 \Device\HarddiskVolume1\WINDOWS\system32\config\software SharedCacheMap 0x89291f90 4 \Device\HarddiskVolume1\WINDOWS\system32\config\software I'm probably just completely misinterpreting the output, but could somebody throw me a bone? Thanks much John

11 years, 1 month

3
4
0 0

Memory Forensics Training by Volatility Developers is headed back to Reston!

by Andrew Case

After quickly selling out our recent course in Reston, we have now scheduled another training there in November: http://volatility-labs.blogspot.com/2013/06/memory-forensics-training-resto… This course is taught directly by Volatility developers, and provides intense training in memory forensics for incident response, malware analysis, and digital forensic investigation. We already have quite a few people signed up and had to turn away people last time, so please contact us ASAP if you are interested in taking it. Thanks, Andrew (@attrc)

11 years, 4 months

1
0
0 0

Cuckoo and Volatility

by Thorsten Sick

Hi List I am writing a Volatility plugin for Cuckoobox: https://github.com/Thorsten-Sick/cuckoo/tree/volatility That allows us to automate Malware analysis. Cuckoobox runs the malware and creates a memory snapshot. Volatility extracts the information, Cuckoobox afterwards generates nice reports from that. These are ready for statistics and automated processing. I hope to get the changes into the next Cuckoobox 0.7. But at the moment using Volatility 2.2 I had to duplicate some code from the Volatility plugins in Cuckoobox. I need data (python dict), not a text log. Instead of duplicating code I would love to have a method in the voaltility plugins that returns the data instead of some text log. I would code that and (if you want) re-create the render_text methods to also use the data from this method. * What do you think ? * Where to submit it for fast review and integration ? * Any other requirements ? * For which volatility version should I code (as far as I know you are about to release 2.3 soonish) Cheers Thorsten Sick -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com

11 years, 4 months

4
4
0 0

Final Week of Month of Volatility Plugins II is posted

by Andrew Case

We are writing as the final week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new and updated plugins used to analyze Mac systems. The first post demonstrated leveraging process cross-view analysis for Mac rootkit detection: http://volatility-labs.blogspot.com/2013/06/movp-ii-41-leveraging-process-c… The second post covered dumping, scanning, and searching process memory: http://volatility-labs.blogspot.com/2013/06/movp-ii-42-dumping-scanning-and… The third post discussed how to recover networking information: http://volatility-labs.blogspot.com/2013/06/movp-ii-43-recovering-mac-os-x-… The fourth post showed a number of artifacts in Mac kernel memory: http://volatility-labs.blogspot.com/2013/06/movp-ii-44-whats-in-your-mac-os… The fifth post analyzed the Rubilyn kernel rootkit and detected it in a number of ways: http://volatility-labs.blogspot.com/2013/06/movp-ii-45-mac-volatility-vs-ru… We hope you have enjoyed this month's posts and will be trying 2.3 when its released! If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

11 years, 5 months

1
0
0 0

Ideas and suggestions for user space memory forensics

by Edwin Smulders

Hi developers and enthusiasts, A while ago I introduced myself here, as I am doing a study into user space memory forensics. My goal is to develop a general method to extract information from user space, from any process. The past few months I have worked on some proof of concepts, and some basic experimentation. This has all been fairly easy, but I want to do something more complex. Today I am mailing you to ask for some ideas and suggestions. To give you an idea of what I have done so far (and the level I'm working on), here's a short list: - Extract register contents from the process kernel stack - Determine the exact locations of stack frames - Make a list of all process threads and access their stacks - Walk a list of pointers and do heuristic search on small structs, such as common networking structs (NOTE: All using a linux dump) All of this worked fairly well, and it was fun, but not exactly groundbreaking. I thought it would be best to ask the advice from professionals before I continue. The direction I would like to take is doing something more foolproof than a heuristic search, I would rather derive the location of structures using information in memory. One idea I had was to identify the whole stack trace (i.e. including function names) and use this to find struct locations. Since there is always the issue of missing symbols, I would somehow have to reintroduce these, and also figure out how dynamic symbols work. I am especially interested in common libraries with this approach, since something I can apply to libraries, I can apply to many processes. Another idea I had would be to use the source/headers of the application, maybe similar to the way volatility uses the symbols for the kernel. Now I don't really have a question about this, I am just looking for ideas. Please tell me if you think my ideas are good, or bad. If you read this and wonder why I don't do X instead of Y, please ask me. Feel free to mention any problems you see coming. I am really looking for a discussion here. The only requirements I have at this moment are that it stays roughly the same topic and it is academically relevant. That last part also means that if you know about somebody doing exactly this, do let me know, so I can do something else. If you know of any technical documentation or scientific research in the area, I'm also interested in that. The most relevant paper (in the whole topic of user space memory forensics) I have read so far is "Digging for Data Structures", Cozzie et al (thanks emdel for showing me that one). I permanently reside on IRC, Freenode/#volatility, if anyone cares to chat some more about the topic. Cheers, Edwin

11 years, 5 months

2
3
0 0

Re: [Vol-dev] Breakpoints On Instruction calls

by A B

Tamas, Nir, Michael, Thank you all for the replies. I suspected something similar about Vmware not synching the vmem file too often. Michael, WinpMem seems to be a very good method (from the video), I deliberately didn't look into the source code yet, because I think I need to develop something similar, and would like to do so from scratch. We cannot use any existing code. I tried to avoid writing a driver since it complicated maintenance and release cycles, typically extending them, but if there is no easy way, perhaps that is the way to go. For my previous driver experience (and please correct me if I am wrong), this driver needs to interpret Windows memory management and open sections of memory and furnish the contents and contexts through IOCTLs to the user mode service for further analysis. A few quick questions : 1. This can be done completely agentless? Which means we need to insert nothing inside the VMs? Everything stays in the hyper-visor. 2. Have you guys tried constructing the call stack for such a break point? So when one hits a memory location and that is a function call, I would like to interpret the frames to get a call stack for the function call? (perhaps this is already mentioned in the video, and I didnt pay enough attention) Thanks amit On Sat, Jun 1, 2013 at 3:33 AM, Michael Cohen <scudette(a)gmail.com> wrote: > Hi ab, > You can use volatility tech preview with live systems by simply loading > the winpmem driver (using the -l option) and then pointing volatility at > the live memory (i.e. the \\.\pmem device). You can also turn on write > support in the driver, and get volatility to write at the memory location. > It should be quite simple to insert instrumentation stubs into code in that > case. > > See the recent dfir workshop where we did just this: > > http://www.youtube.com/watch?v=9aC7yIYwvAY > > Michael. > > > On 31 May 2013 17:22, A B <amitrajitb(a)gmail.com> wrote: > >> All, >> >> This is my first post in this forum, and I am also very new to this >> website, so please excuse my ignorance. >> >> This is a fantastic project no doubt. >> >> >> Now, coming to my questions: >> >> 1. Is it possible to run volatility on a running 'live' VM's memory? That >> is, assuming that I have vmware work station running, can I use the live >> vmem file as input and get reliavble outputs? >> >> 2. If one is possible, then is it possible to generate a breakpoint or >> get a call back when a particular memory location is hit? I ask this >> because, assuming that an executable is loaded in certain pages inside the >> vmem, and I want to get notified when a particular function of that loaded >> executable is called, this wuld mean that when the virtual CPU executes the >> first instruction of that function I need a callback, is that possible? >> >> thanks in advance... >> >> -- >> >> - ab >> >> _______________________________________________ >> Vol-dev mailing list >> Vol-dev(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev >> >> > -- - ab

11 years, 5 months

2
1
0 0

Third Week of Month of Volatility Plugins II is posted

by Andrew Case

We are writing as the third week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new and updated plugins used to analyze Linux and Android systems. The first post covered two new methods to detect kernel-level keyloggers: http://volatility-labs.blogspot.com/2013/05/movp-ii-31-linux-checktty.html The second post covered using Python and Yara to help with Linux & Android memory analysis: http://volatility-labs.blogspot.com/2013/05/movp-ii-32-linuxandroid-memory.… The third post discussed the updated and now automated bash history scanner: http://volatility-labs.blogspot.com/2013/05/movp-ii-33-automated-linuxandro… The fourth post discussed checking the ARM (Android) system call table and exception vector table for signs of rootkits: http://volatility-labs.blogspot.com/2013/06/movp-ii-34-checking-arm-android… The fifth post discussed utilizing the kmem_cache on Android systems: http://volatility-labs.blogspot.com/2013/06/movp-ii-35-utilizing-kmemcache-… We hope you enjoy the posts, and the fourth and final week of posts will begin tomorrow and cover a number of new plugins to help analyze Mac samples. If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

11 years, 5 months

1
0
0 0

Breakpoints On Instruction calls

by A B

All, This is my first post in this forum, and I am also very new to this website, so please excuse my ignorance. This is a fantastic project no doubt. Now, coming to my questions: 1. Is it possible to run volatility on a running 'live' VM's memory? That is, assuming that I have vmware work station running, can I use the live vmem file as input and get reliavble outputs? 2. If one is possible, then is it possible to generate a breakpoint or get a call back when a particular memory location is hit? I ask this because, assuming that an executable is loaded in certain pages inside the vmem, and I want to get notified when a particular function of that loaded executable is called, this wuld mean that when the virtual CPU executes the first instruction of that function I need a callback, is that possible? thanks in advance... -- - ab

11 years, 5 months

3
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-dev