- Vol-dev - volatilityfoundation.org

Three 2014 Volatility & Memory Forensics trainings are now scheduled

by Andrew Case

As we previously sent to the list, the Volatility team will be holding training sessions in San Diego in January and London in June: http://volatility-labs.blogspot.com/2013/09/2014-malware-and-memory-forensi… We have now also finalized plans for a training in NYC in May: http://volatility-labs.blogspot.com/2013/10/2014-malware-and-memory-forensi… These will be the only public trainings through August of next year, and we have already received substantial interest in each one. If you plan to attend do not wait until the last minute to contact us as for our last several trainings we have had to turn away people once the classroom fills. If your company is interested in a private training or hosting a public training in exchange for a few free seats then please let us know ASAP as these opportunities for 2014 will likely be taken by other companies over the next month or two. Finally, the Volatility team would like to thank everyone who came out to OMFW and to those of you who attended our OSDFC talk and showed support for the project. Over the next couple weeks we will be sending out slides and updates from OMFW, and please reach out to us if you have questions for any of the speakers that you did not get to ask in person. Thanks, Andrew (@attrc)

11 years, 7 months

1
0
0 0

New plugins: Filelist and Virustotal

by Sebastien Bourdon-Richard

Hi, Based on the work AAron and the Volatility team have done for the dumpfiles plugin (thanks for the plugin btw), I have wrote two new plugins for Volatility. I have coded those plugins to learn more about the new dumpfiles plugin. I'm sharing them hoping they will be useful for someone else. The first plugin is filelist. It is used to list files that can be extracted by the dumpfiles plugin. The second plugin is virustotal and it is used to query/submit cached memory files to virustotal. Both plugins can be downloaded here [1]. Here's some examples on how to use the filelist plugin. Memory sample [2] was used for the examples. List exe files in the memory dump: C:\Volatility>python vol.py -f Bob.vmem filelist -r \.exe Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------- 0x81dd28d0 548 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\smss.exe 0x822741c8 612 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x81d45b00 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x822ec7f8 688 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\services.exe 0x81e5c028 700 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe 0x8226ba70 852 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmacthlp.exe 0x81d476d8 880 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x81d476d8 880 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x822dfbd0 1460 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe 0x82113220 1628 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmtoolsd.exe 0x81d163f8 1836 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe 0x81cf83a0 2024 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\alg.exe 0x81e584c0 1756 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81e584c0 1756 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x81ca9028 1108 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x81ca9028 1108 No DataSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x820cdbd8 1116 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareUser.exe 0x820a83a8 1132 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe 0x81cbdd18 244 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x81cbdd18 244 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\msiexec.exe 0x820c3298 440 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x820c3298 440 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x81dc2e90 888 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x81dc2e90 888 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe 0x82077868 1752 Yes ImageSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe 0x82077868 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe List all files opened by PID 644 (i.e: winlogon.exe with Zeus/Zbot injected): C:\Volatility>python vol.py -f Bob.vmem filelist -p 644 Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ------------------------------------------------------------------------------------- 0x82264028 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe 0x81ebe598 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\user.ds 0x822e3ea0 644 Yes DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\lowsec\local.ds 0x81f14590 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls 0x81ebe028 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls 0x81e4f4b0 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\locale.nls 0x822a4210 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls 0x822da598 644 No DataSectionObject \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls 0x81d45b00 644 Yes ImageSectionObject \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe […] List DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem filelist -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 Offset PID Present Type File Name ------------ ----- ------- -------------------- ----------------------------------------------------------------------------------------------- 0x81c8c8e8 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp 0x8206f028 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp 0x81dfadf0 1752 Yes DataSectionObject \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php 0x81ec1960 1752 Yes DataSectionObject \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf 0x81ec8f90 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...Temporary Internet Files\Content.IE5\index.dat 0x820da3d8 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat 0x820da470 1752 Yes DataSectionObject \Device\HarddiskVolume1\Documents and Settings...r\Local Settings\History\History.IE5\index.dat Here's some examples on how to use the virustotal plugin. Please note that Virustotal plugin does not submit any files to VT by default. To use this plugin, edit virustotal.py and enter your VT API Key. By default, the plugin operate in public mode (i.e: maximum 4 requests per minute to VT). However, if you have a private key, it's possible to adjust the delay between queries with the --delay option. Query Virustotal for the file sdra64.exe present in memory: C:\Volatility>python vol.py -f Bob.vmem virustotal -r sdra64\.exe Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe Cache file type: DataSectionObject PID: 644 MD5: b3e40cb29a3125ac862570ed5b5212a5 Detection ratio: 38/41 Analysis date: 2010-05-23 00:22:26 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Trojan.Generic.KD.387 20100522 CAT-QuickHeal Win32.Packed.Krap.ao.4 20100521 McAfee PWS-Zbot.gen.ak 20100523 TheHacker Trojan/Kryptik.cqz 20100522 VirusBuster Trojan.Kryptik.IBE 20100522 NOD32 a variant of Win32/Kryptik.CQZ 20100522 F-Prot W32/Agent.FG.gen!Eldorado 20100523 Symantec Packed.Generic.292 20100522 Norman W32/Zbot.PFX 20100522 TrendMicro-HouseCall TROJ_ZBOT.AZR 20100523 Avast Win32:Crypt-FWN 20100522 eSafe None 20100520 ClamAV Trojan.Zbot-8228 20100522 Kaspersky Packed.Win32.Krap.ao 20100522 BitDefender Trojan.Generic.KD.387 20100523 Comodo TrojWare.Win32.TrojanSpy.Zbot.Gen 20100522 F-Secure Trojan.Generic.KD.387 20100522 DrWeb Trojan.Winlock.1115 20100522 AntiVir TR/Agent.AO.177 20100521 TrendMicro TROJ_ZBOT.AZR 20100522 McAfee-GW-Edition PWS-Zbot.gen.ak 20100522 Sophos Mal/FakeAV-BW 20100522 eTrust-Vet Win32/FakeAV!generic 20100521 Authentium W32/Agent.FG.gen!Eldorado 20100522 Jiangmin Packed.Krap.cfls 20100522 Antiy-AVL Packed/Win32.Krap.gen 20100521 a-squared Packed.Win32.Krap!IK 20100510 Microsoft Trojan:Win32/Malagent 20100522 ViRobot None 20100522 Prevx Medium Risk Malware 20100523 GData Trojan.Generic.KD.387 20100522 AhnLab-V3 Win-Trojan/Burnix.Gen 20100522 VBA32 Trojan.Win32.Inject.anij 20100522 Sunbelt Trojan-Spy.Win32.Zbot.gen (v) 20100522 PCTools HeurEngine.MaliciousPacker 20100522 Rising Trojan.Win32.Generic.51FFF748 20100522 Ikarus Packed.Win32.Krap 20100522 Fortinet None 20100522 AVG Cryptic.BL 20100523 Panda Trj/Krap.Y 20100522 Avast5 Win32:Crypt-FWN 20100522 Query DataSectionObject files listed in the HandleTable for the AcroRd32.exe process (PID 1752): C:\Volatility>python vol.py -f Bob.vmem virustotal -p 1752 -F DataSectionObject,HandleTable Volatility Foundation Volatility Framework 2.3 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr107.tmp Cache file type: DataSectionObject PID: 1752 MD5: aeb2581f6c99b4434fb8ed96aeb3e43d Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:31 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Acr106.tmp Cache file type: DataSectionObject PID: 1752 MD5: c6ea3ec108b4610831883617dc877f4b Detection ratio: 0/42 Analysis date: 2010-04-04 15:04:05 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 201005 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\Program Files\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf Cache file type: DataSectionObject PID: 1752 MD5: cd3c38c9c0e910bf1fe722871039cf3d Detection ratio: 0/42 Analysis date: 2010-04-04 18:36:07 ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 1b6e92d96236f8d2307412283c7666cb File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Cookies\index.dat Cache file type: DataSectionObject PID: 1752 MD5: 7b00dbeb59f8fc8e70f291731bd36811 File not present on VirusTotal ************************************************************************ File: \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Cache file type: DataSectionObject PID: 1752 MD5: b995dc0123737ae13a70f71c88657daf File not present on VirusTotal * Query all pdf.php files in memory (ignore case) and upload any file that is unknown to VirusTotal:* C:\Volatility>python vol.py -f Bob.vmem virustotal -r pdf.php -i --submit Volatility Foundation Volatility Framework 2.3 *********************************************************************** File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: DataSectionObject PID: 1752 MD5: cb5bfbeaa27248ca8218414c61da9a56 Detection ratio: 13/41 Analysis date: 2010-05-13 13:08:49 Antivirus Result Update ------------------------- ---------------------------------------- ------------ nProtect Exploit.PDF-Name.Gen 20100513 CAT-QuickHeal None 20100513 McAfee None 20100513 TheHacker None 20100513 VirusBuster None 20100512 NOD32 None 20100513 F-Prot None 20100513 Symantec Bloodhound.PDF.8 20100513 Norman None 20100513 TrendMicro-HouseCall None 20100513 Avast JS:Pdfka-gen 20100513 eSafe None 20100511 ClamAV None 20100513 Kaspersky None 20100513 BitDefender Exploit.PDF-Name.Gen 20100513 Comodo UnclassifiedMalware 20100513 F-Secure Exploit.PDF-Name.Gen 20100513 DrWeb None 20100513 AntiVir None 20100512 TrendMicro None 20100513 McAfee-GW-Edition None 20100513 Sophos Mal/PDFEx-D 20100513 eTrust-Vet None 20100513 Authentium None 20100513 Jiangmin None 20100513 Antiy-AVL None 20100513 a-squared Exploit.Win32.Pdfjsc!IK 20100510 Microsoft Exploit:Win32/Pdfjsc.EF 20100513 ViRobot None 20100513 Prevx None 20100513 GData Exploit.PDF-Name.Gen 20100513 AhnLab-V3 None 20100513 VBA32 None 20100513 Sunbelt None 20100513 PCTools HeurEngine.PDF 20100513 Rising None 20100513 Ikarus Exploit.Win32.Pdfjsc 20100513 Fortinet None 20100513 AVG None 20100513 Panda None 20100512 Avast5 JS:Pdfka-gen 20100513 ************************************************************************ File: \Device\HarddiskVolume1\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plugtmp\PDF.php Cache file type: SharedCacheMap PID: 1752 MD5: ef6f0c1e573d6fbfa9c5b0d77cfbe2cd File not present on VirusTotal. Uploading file... Scan request successfully queued, come back later for the report Requested item is still queued for analysis...waiting 60 seconds Requested item is still queued for analysis...waiting 60 seconds Detection ratio: 17/40 Analysis date: 2013-10-14 19:35:44 Antivirus Result Update ------------------------- ---------------------------------------- ------------ MicroWorld-eScan Exploit.PDF-Name.Gen 20131014 nProtect Exploit.PDF-Name.Gen 20131014 CAT-QuickHeal None 20131014 McAfee None 20131014 Malwarebytes None 20131014 K7AntiVirus None 20131014 K7GW None 20131014 TheHacker None 20131014 NANO-Antivirus Exploit.Script.Pdfka.lcgj 20131014 F-Prot None 20131014 Symantec Bloodhound.PDF.8 20131014 Norman Obfuscated.JS 20131014 ByteHero None 20130923 Avast JS:Pdfka-gen [Expl] 20131014 ClamAV Heuristics.PDF.ObfuscatedNameObject 20131013 Kaspersky None 20131014 BitDefender Exploit.PDF-Name.Gen 20131012 Agnitum None 20131014 ViRobot None 20131014 Emsisoft Exploit.PDF-Name.Gen (B) 20131014 Comodo None 20131014 DrWeb SCRIPT.Virus 20131014 AntiVir EXP/Pidief.OR 20131014 McAfee-GW-Edition None 20131014 Sophos Mal/PdfEx-C 20131014 Jiangmin None 20131014 Panda None 20131014 Antiy-AVL None 20131014 Kingsoft None 20130829 Microsoft Exploit:Win32/Pdfjsc.EF 20131014 SUPERAntiSpyware None 20131014 GData Exploit.PDF-Name.Gen 20131014 Commtouch PDF/Obfusc.G!Camelot 20131014 TotalDefense None 20131011 VBA32 None 20131014 PCTools HeurEngine.PDF 20131002 ESET-NOD32 None 20131014 Ikarus Exploit.JS.Pdfka 20131014 Fortinet None 20131014 Baidu-International None 20131014 Hope this help! Regards, Sebastien [1]: https://github.com/sebastienbr/Volatility/tree/master/plugins [2]: https://www.honeynet.org/challenges/2010_3_banking_troubles

11 years, 8 months

1
0
0 0

probably a really dump question RE: the new dumpfiles plugin

by McCash John-GKJN37

Hi, I'd been looking forward to the new dumpfiles plugin for a while, so I immediately downloaded it and tried it out as soon as possible after I saw it had finally been committed to the source tree the other day. (I'm freely admitting I'm using the thing without any documentation, since that still hasn't been committed, and probably have no idea what I'm really doing.) Now, I have a dumb question. The names of the dumped files are all of the format: file.<number>.<hex number>.< dat |img |vacb> In addition, the dumping process produces a bunch of output, of the form: <DataSectionObject|ImageSectionObject|SharedCacheMap> <hex number> <number> <file path> with no column header or other indication of what exactly these values refer to. (If I had to guess, maybe the hex value is the data offset within the image?) Looking at this format (without knowing for sure exactly what the numbers are referring to) would lead me to expect that the <number> and <hex number> fields from the output should correspond to the ones in the dumped filenames, and thus the file paths should have some correspondence to the dumped file data, if the values match up. Not necessarily being the contents of exact file to which the path corresponds, but being related in some way. But I'm not seeing the same hex value show up anywhere in the output and in ANY filename... Trying for a specific correspondence, I went looking through the dumped files, and was able to positively identify the Software registry hive. The associated filename was file.4.0x8697a2b8.vacb. Looking through the output for entries associated with this file identified the following two entries: DataSectionObject 0x89291f90 4 \Device\HarddiskVolume1\WINDOWS\system32\config\software SharedCacheMap 0x89291f90 4 \Device\HarddiskVolume1\WINDOWS\system32\config\software I'm probably just completely misinterpreting the output, but could somebody throw me a bone? Thanks much John

11 years, 8 months

3
4
0 0

Memory Forensics Training by Volatility Developers is headed back to Reston!

by Andrew Case

After quickly selling out our recent course in Reston, we have now scheduled another training there in November: http://volatility-labs.blogspot.com/2013/06/memory-forensics-training-resto… This course is taught directly by Volatility developers, and provides intense training in memory forensics for incident response, malware analysis, and digital forensic investigation. We already have quite a few people signed up and had to turn away people last time, so please contact us ASAP if you are interested in taking it. Thanks, Andrew (@attrc)

11 years, 12 months

1
0
0 0

Cuckoo and Volatility

by Thorsten Sick

Hi List I am writing a Volatility plugin for Cuckoobox: https://github.com/Thorsten-Sick/cuckoo/tree/volatility That allows us to automate Malware analysis. Cuckoobox runs the malware and creates a memory snapshot. Volatility extracts the information, Cuckoobox afterwards generates nice reports from that. These are ready for statistics and automated processing. I hope to get the changes into the next Cuckoobox 0.7. But at the moment using Volatility 2.2 I had to duplicate some code from the Volatility plugins in Cuckoobox. I need data (python dict), not a text log. Instead of duplicating code I would love to have a method in the voaltility plugins that returns the data instead of some text log. I would code that and (if you want) re-create the render_text methods to also use the data from this method. * What do you think ? * Where to submit it for fast review and integration ? * Any other requirements ? * For which volatility version should I code (as far as I know you are about to release 2.3 soonish) Cheers Thorsten Sick -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com

12 years

4
4
0 0

Final Week of Month of Volatility Plugins II is posted

by Andrew Case

We are writing as the final week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new and updated plugins used to analyze Mac systems. The first post demonstrated leveraging process cross-view analysis for Mac rootkit detection: http://volatility-labs.blogspot.com/2013/06/movp-ii-41-leveraging-process-c… The second post covered dumping, scanning, and searching process memory: http://volatility-labs.blogspot.com/2013/06/movp-ii-42-dumping-scanning-and… The third post discussed how to recover networking information: http://volatility-labs.blogspot.com/2013/06/movp-ii-43-recovering-mac-os-x-… The fourth post showed a number of artifacts in Mac kernel memory: http://volatility-labs.blogspot.com/2013/06/movp-ii-44-whats-in-your-mac-os… The fifth post analyzed the Rubilyn kernel rootkit and detected it in a number of ways: http://volatility-labs.blogspot.com/2013/06/movp-ii-45-mac-volatility-vs-ru… We hope you have enjoyed this month's posts and will be trying 2.3 when its released! If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

12 years

1
0
0 0

Ideas and suggestions for user space memory forensics

by Edwin Smulders

Hi developers and enthusiasts, A while ago I introduced myself here, as I am doing a study into user space memory forensics. My goal is to develop a general method to extract information from user space, from any process. The past few months I have worked on some proof of concepts, and some basic experimentation. This has all been fairly easy, but I want to do something more complex. Today I am mailing you to ask for some ideas and suggestions. To give you an idea of what I have done so far (and the level I'm working on), here's a short list: - Extract register contents from the process kernel stack - Determine the exact locations of stack frames - Make a list of all process threads and access their stacks - Walk a list of pointers and do heuristic search on small structs, such as common networking structs (NOTE: All using a linux dump) All of this worked fairly well, and it was fun, but not exactly groundbreaking. I thought it would be best to ask the advice from professionals before I continue. The direction I would like to take is doing something more foolproof than a heuristic search, I would rather derive the location of structures using information in memory. One idea I had was to identify the whole stack trace (i.e. including function names) and use this to find struct locations. Since there is always the issue of missing symbols, I would somehow have to reintroduce these, and also figure out how dynamic symbols work. I am especially interested in common libraries with this approach, since something I can apply to libraries, I can apply to many processes. Another idea I had would be to use the source/headers of the application, maybe similar to the way volatility uses the symbols for the kernel. Now I don't really have a question about this, I am just looking for ideas. Please tell me if you think my ideas are good, or bad. If you read this and wonder why I don't do X instead of Y, please ask me. Feel free to mention any problems you see coming. I am really looking for a discussion here. The only requirements I have at this moment are that it stays roughly the same topic and it is academically relevant. That last part also means that if you know about somebody doing exactly this, do let me know, so I can do something else. If you know of any technical documentation or scientific research in the area, I'm also interested in that. The most relevant paper (in the whole topic of user space memory forensics) I have read so far is "Digging for Data Structures", Cozzie et al (thanks emdel for showing me that one). I permanently reside on IRC, Freenode/#volatility, if anyone cares to chat some more about the topic. Cheers, Edwin

12 years

2
3
0 0

Re: [Vol-dev] Breakpoints On Instruction calls

by A B

Tamas, Nir, Michael, Thank you all for the replies. I suspected something similar about Vmware not synching the vmem file too often. Michael, WinpMem seems to be a very good method (from the video), I deliberately didn't look into the source code yet, because I think I need to develop something similar, and would like to do so from scratch. We cannot use any existing code. I tried to avoid writing a driver since it complicated maintenance and release cycles, typically extending them, but if there is no easy way, perhaps that is the way to go. For my previous driver experience (and please correct me if I am wrong), this driver needs to interpret Windows memory management and open sections of memory and furnish the contents and contexts through IOCTLs to the user mode service for further analysis. A few quick questions : 1. This can be done completely agentless? Which means we need to insert nothing inside the VMs? Everything stays in the hyper-visor. 2. Have you guys tried constructing the call stack for such a break point? So when one hits a memory location and that is a function call, I would like to interpret the frames to get a call stack for the function call? (perhaps this is already mentioned in the video, and I didnt pay enough attention) Thanks amit On Sat, Jun 1, 2013 at 3:33 AM, Michael Cohen <scudette(a)gmail.com> wrote: > Hi ab, > You can use volatility tech preview with live systems by simply loading > the winpmem driver (using the -l option) and then pointing volatility at > the live memory (i.e. the \\.\pmem device). You can also turn on write > support in the driver, and get volatility to write at the memory location. > It should be quite simple to insert instrumentation stubs into code in that > case. > > See the recent dfir workshop where we did just this: > > http://www.youtube.com/watch?v=9aC7yIYwvAY > > Michael. > > > On 31 May 2013 17:22, A B <amitrajitb(a)gmail.com> wrote: > >> All, >> >> This is my first post in this forum, and I am also very new to this >> website, so please excuse my ignorance. >> >> This is a fantastic project no doubt. >> >> >> Now, coming to my questions: >> >> 1. Is it possible to run volatility on a running 'live' VM's memory? That >> is, assuming that I have vmware work station running, can I use the live >> vmem file as input and get reliavble outputs? >> >> 2. If one is possible, then is it possible to generate a breakpoint or >> get a call back when a particular memory location is hit? I ask this >> because, assuming that an executable is loaded in certain pages inside the >> vmem, and I want to get notified when a particular function of that loaded >> executable is called, this wuld mean that when the virtual CPU executes the >> first instruction of that function I need a callback, is that possible? >> >> thanks in advance... >> >> -- >> >> - ab >> >> _______________________________________________ >> Vol-dev mailing list >> Vol-dev(a)volatilityfoundation.org >> http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev >> >> > -- - ab

12 years

2
1
0 0

Third Week of Month of Volatility Plugins II is posted

by Andrew Case

We are writing as the third week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new and updated plugins used to analyze Linux and Android systems. The first post covered two new methods to detect kernel-level keyloggers: http://volatility-labs.blogspot.com/2013/05/movp-ii-31-linux-checktty.html The second post covered using Python and Yara to help with Linux & Android memory analysis: http://volatility-labs.blogspot.com/2013/05/movp-ii-32-linuxandroid-memory.… The third post discussed the updated and now automated bash history scanner: http://volatility-labs.blogspot.com/2013/05/movp-ii-33-automated-linuxandro… The fourth post discussed checking the ARM (Android) system call table and exception vector table for signs of rootkits: http://volatility-labs.blogspot.com/2013/06/movp-ii-34-checking-arm-android… The fifth post discussed utilizing the kmem_cache on Android systems: http://volatility-labs.blogspot.com/2013/06/movp-ii-35-utilizing-kmemcache-… We hope you enjoy the posts, and the fourth and final week of posts will begin tomorrow and cover a number of new plugins to help analyze Mac samples. If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

12 years

1
0
0 0

Breakpoints On Instruction calls

by A B

All, This is my first post in this forum, and I am also very new to this website, so please excuse my ignorance. This is a fantastic project no doubt. Now, coming to my questions: 1. Is it possible to run volatility on a running 'live' VM's memory? That is, assuming that I have vmware work station running, can I use the live vmem file as input and get reliavble outputs? 2. If one is possible, then is it possible to generate a breakpoint or get a call back when a particular memory location is hit? I ask this because, assuming that an executable is loaded in certain pages inside the vmem, and I want to get notified when a particular function of that loaded executable is called, this wuld mean that when the virtual CPU executes the first instruction of that function I need a callback, is that possible? thanks in advance... -- - ab

12 years

3
2
0 0

Second Week of Month of Volatility Plugins II is posted

by Andrew Case

We are writing as the second week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new and updated plugins used to analyze Windows systems. The first post discussed recovering RSA Private Keys and SSL Certificates from memory: http://volatility-labs.blogspot.com/2013/05/movp-ii-21-rsa-private-keys-and… The second post discussed recovering information about unloaded kernel modules from memory: http://volatility-labs.blogspot.com/2013/05/movp-ii-22-unloaded-windows-ker… The third post showed how to create timelines with in-memory data using Volatility: http://volatility-labs.blogspot.com/2013/05/movp-ii-23-creating-timelines-w… The fourth post demonstrated how to recover MFT entries and utilize them during investigations: http://volatility-labs.blogspot.com/2013/05/movp-ii-24-reconstructing-maste… The last post highlighted a number of new and updated plugins that are very useful during investigations: http://volatility-labs.blogspot.com/2013/05/movp-ii-25-new-and-improved-win… We hope you enjoy the posts, and the third week of posts will begin tomorrow and cover a number of new plugins to help analyze Linux and Android samples. If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

12 years

1
0
0 0

Getting free memory pages

by Kiryong Ha

Hi all, I'm wondering that I can use volatile to get the free memory pages of the operating system. I have looked up wiki pages but couldn't find any primitive operation that returns a list of free memory pages. I believe getting free memory pages will be beneficial to many areas including VM migration and efficient memory management of the multiple VMs. Does anyone has idea? -- Kiryong

12 years, 1 month

1
0
0 0

Automated Volatility Plugin Generation with Dalvik Inspector

by Joe Sylve

Hello, We wanted to take the opportunity to point you to a blog post which gives a preview of some of the research we've been working on at 504ENSICS Labs in the area of Android memory analysis. This time we are demoing a feature that will allow automatted volatility plugin generation with our Dalvik Inspector tool. We think our results will be of great interest to the DFIR community and look forward to your feed back. We plan on releasing the tool this year at Black Hat. The blog post can be found here: http://www.504ensics.com/automated-volatility-plugin-generation-with-dalvik… --- *Joe T. Sylve, M.S.* Co-Founder 504ENSICS Labs (504) 210-8270 (Office) http://www.504ensics.com PGP Key: http://www.504ensics.com/pgp_keys/joesylve.asc

12 years, 1 month

1
0
0 0

First week of Month of Volatility Plugins II is posted

by Andrew Case

Hello, We are writing as the first week of the second installment of the Month of Volatility Plugins is now posted. Volatility 2.3 is currently in beta, and the blog posts are focusing on new features in this version. This week's posts discussed a number of new address spaces we have added to support new hardware architectures and file formats. The first one is the MachO address space used to support Mac Memory Reader: http://volatility-labs.blogspot.com/2013/05/movp-ii-11-mach-o-address-space… The second is an address space used to support VirtualBox: http://volatility-labs.blogspot.com/2013/05/movp-ii-12-virtualbox-elf64-cor… The third address space allows for analysis of VMware snapshot files (.vmss and .vmsn): http://volatility-labs.blogspot.com/2013/05/movp-ii-13-vmware-snapshot-and-… The fourth address space supports the hpak format of the HBGary Fast Dump acquisition tool: http://volatility-labs.blogspot.com/2013/05/movp-ii-14-new-hpak-address-spa… The final address space discussed adds support for the ARM architecture. This is leveraged by Volatility's Android support: http://volatility-labs.blogspot.com/2013/05/movp-ii-15-arm-address-space-vo… We hope you enjoy the posts, and the second installment of posts will begin tomorrow and cover a number of new plugins to help analyzing Windows samples. If you have any questions or comments please comment on an individual blog post or reply to this email. Thanks, Andrew (@attrc)

12 years, 1 month

1
0
0 0

Volatility News

by Jamie Levy

For those of you interested in applying memory forensics to your malware analysis and rootkit detection efforts, we've just posted a new blog with some exciting news and updates: http://volatility-labs.blogspot.com/2013/05/whats-happening-in-world-of-vol… * Volatility 2.3 will enter beta this week and we'll introduce the new features over the next four weeks (Month of Volatility Plugins II). * There are three training courses open for registration (Reston in June, Netherlands in September, Vermont in November). Email voltraining(a)memoryanalysis.net for details. * The plugin contest submissions are starting to trickle in. Enter to win over $2250 in cash or a free seat at an upcoming training. * This year's Open Memory Forensics Workshop will be in Chantilly VA on November 4th, alongside OSDFC (Open Source Digital Forensics Conference). CFP to be announced soon. All the best, Jamie / @gleeda The Volatility Project -- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

12 years, 1 month

1
0
0 0

Method to get absolute physical address

by Frédéric Baguelin

Hi List, It's my first post here, so first of all, thanks a lot for this project ! I'm currently working with Volatility 2.2 (testing with 2.3 too) to link it with DFF [1]. I've almost finished my module but a co-worker provided me a dump acquired via VirtualBox. Thereferore, I used latest vboxelf.py available in trunk on the svn but here is the problem: DFF'API provides some mechanism to represent file mapping: logical offset, size, physical offset and underlying file for each chunk of data. This is how we are able to have access to all exe, dlls and modules without having to extract them with Volatility. Precisely, I adapted the code used by procexedump to be able to push each chunk. At least, I have the same sha1 than files created with procexedump even if some chunk are overlapping but this is off topic So, when having the following layers, everything is ok: AS Layer 1 JKIA32PagedMemoryPae ( Kernel AS ) AS Layer 2 dffAdressSpace ( /Logical files/ds_fuzz_hidden_proc.img ) __But__ when dealing with the following ones: AS Layer 1 JKIA32PagedMemoryPae ( Kernel AS ) AS Layer 2 VirtualBoxCoreDumpElf64 ( Unnamed AS ) AS Layer 3 dffAdressSpace ( /Logical files/Window7_2013-04-24_18_51_39.310504 ) Content for each exe, dll and module is wrong. In the code where I push chunk for each files, I use vtop() method of the corresponding address space but since there is another level here, I'm missing the last translation of the address. The vtop() returns what could be seen as a virtual address for the Layer 2. So I dug the code of vboxelf.py and saw there was a get_addr() method I could use but it is not a "standardized" method. The issue would be the same with a dump acquired with Lime for example (which has __get_offset() method itself). So here is my question, could it be possible to implement a standard method in each address space plugins to be able to obtain the corresponding address for the underlying layer ? Finally, either having a global function iterating on each layer to provide the "absolute" physical address or something like that. Regards, [1] http://www.digital-forensic.org/ -- Frédéric Baguelin frederic.baguelin(a)arxsys.fr ArxSys SAS, Directeur technique Tél: +33 146 362 522

12 years, 1 month

2
2
0 0

get_symbol

by Pranjal Jumde

Hi, I am trying to get the value of the symbol "bt_proto" using the member function get_symbol, I checked using gdb that this symbol is a part of the bluetooth kernel module. But, I get the following error message "volatility.plugins.overlays.linux.linux: Requested symbol bt_proto not found in module kernel". Any thoughts why this might be happening? Thanks! Regards Pranjal Jumde

12 years, 1 month

5
6
0 0

Memory Forensics Training by Volatility Developers is coming to the Netherlands!

by Andrew Case

We are happy to announce that our memory forensics training course will be going to the Netherlands in September: http://volatility-labs.blogspot.com/2013/04/memory-forensics-training-nethe… This course is taught directly by Volatility developers, and will provide intense training in memory forensics for incident response, malware analysis, and digital forensic investigation. This will be our only course outside of the USA in 2013, and we have already had a number of people inquire about attending, so please contact us ASAP if you are interested in taking it. Thanks, Andrew (@attrc)

12 years, 1 month

1
0
0 0

Pythonisms and volatility-isms for structs

by Edwin Smulders

Hello all, I have arrived at an implementation part of my research and I was wondering if you have any advice or documentation on some "pythonisms" and "volatility-isms" I could be using to do this implementation. My question is two-fold: 1) I have acquired a small part of memory using read/zread and want to match (not search) this part of memory to a specific pattern. Do you know of any pythonisms I could be using, other than checking and matching byte by byte? Is there some type pattern I could use? I suspect I'll just have to evaluate a list of rules, but I figured I'd ask anyway. 2) Some parts of memory I am interested in are originally (C) structs, I'd like to map these to objects similar to the way this is done for structs like 'task_struct' and 'mm_struct', is there any documentation on the way this is done? If it matters, this is all in process address space. Cheers, Edwin

12 years, 2 months

3
6
0 0

Actaeon - Volatility Plugin

by emdel

Hello guys, After several months I have the alpha version of my plugin. Actaeon is a tool to perform memory forensics of virtualization environments. Starting from a physical memory dump, Actaeon can achieve three important goals: 1) locate any Hypervisor (virtual machine monitor) that uses the Intel VT-x technology, 2) detect and analyze nested virtualization and show the relationships among different hypervisors running on the same machine, and 3) provide a transparent mechanism to recognize and support the address space of the virtual machines. You can have more information by visiting the following site: http://s3.eurecom.fr/tools/actaeon/ I would like to have feedback (positive or negative) and ideas from you. Let's improve Actaeon and Volatility :) -- /mariano

12 years, 2 months

1
0
0 0

Symbol Table

by Pranjal Jumde

Hi, Is it possible to get the symbol table of a module? The module structure has a member called symtab but, is it possible to get the symbol names and values from it. Thanks!

12 years, 2 months

1
0
0 0

Issues with using the cache

by Carl Pulley

Hi, I'm currently attempting to get caching working with some library code that exists outside a plugin. The code is parsing debugging symbol tables and so some caching would be useful for performance purposes. The use of caching is normally controlled at the command line via the --cache option. Within running library code, I'm using the following pattern to detect if the --cache option was specified: import volatility.conf as conf class Library(object): def __init__(self, *args, **kwargs): config = conf.ConfObject() # singleton object if config.CACHE: print "cache enabled" else: print "cache disabled" BTW, I'm aware that one can use the --debug option to see if caching is enabled at the terminal. If one now places this code within the volatility directory and then calls it via a plugin - for example with say: import volatility.plugins.common as common from volatility.library import Library class TestPlugin(common.AbstractWindowsCommand): def __init__(self, *args, **kwargs): common.AbstractWindowsCommand.__init__(self, *args, **kwargs) lib = Library() and now if we run the plugin, I consistently observe that the --cache option is reported as disabled. I've tried triggering cache enabling via a callback to cache.enable_caching with no joy. Any help is greatly appreciated. Many thanks, Carl.

12 years, 2 months

1
0
0 0

Android Application (Dalvik) Memory Analysis & the Chuli Malware

by Joe Sylve

Hello, We wanted to take the opportunity to point you to a blog post which gives a preview of some of the research we've been working on at 504ENSICS Labs in the area of Android memory analysis. We think our results will be of great interest to the DFIR community and look forward to your feed back. The blog post can be found here: http://www.504ensics.com/android-application-dalvik-memory-analysis-the-chu… --- Joe T. Sylve, M.S. Co-Founder 504ENSICS Labs www.504ensics.com | (504) 210-8270

12 years, 2 months

1
0
0 0

Plugin contest questions

by emdel

Hello guys, I would like to ask you some questions about the plugin contest. First of all, if I decide to submit my new plugin to the contest do i have to keep it private until the notification (August)? Second point, is it possible to post here some screencasts to have some feedbacks and then submit my cool plugin to the contest? I'm a PhD student so I would like to make my work public once I have submitted the paper. Regards, /emdel

12 years, 3 months

2
1
0 0

Official Training by Volatility - Reston/VA, June 2013

by Jamie Levy

We are pleased to announce the next public Volatility training opportunity: the Windows Malware and Memory Forensics Training by The Volatility Project. This course will take place in Reston, VA from Monday, June 10th through Friday, June 14th 2013. For details, please see our blog: http://volatility-labs.blogspot.com/2013/03/official-training-by-volatility… or email us at: voltraining(a)memoryanalysis.net All the best, -gleeda -- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

12 years, 3 months

1
0
0 0

Automated and generic Android app analysis in Volatility

by Alex Joss

Hi all, We (Alex Joss and Dario Schwab) worked on a set of Volatility plugins for a generic and automated analysis of Android apps that we would like to share with you. This work resulted from our bachelor thesis at Security Engineering Lab of Bern University of Applied Sciences in Switzerland. For now, this is just a proof of concept and it will be developed further in the future. Our approach is based on the dalvik-plugins from Holger Macht, published to this mailing list on 2012-10-16. Our plugins are the following: - android_find_class_instances (scans the heap of the app) - android_app_generic (analyses the contents of the found objects) There are a few more files which have to be added or modified. Under the following link you will find the complete Volatility 2.3-alpha framework with our plugins and modifications already intergrated: https://dl.dropbox.com/u/12931232/volatility-2.3-devel-android.zip Unfortunately we can't provide a patch set, because our work's based on Volatility 2.3-alpha, which can't be downloaded anymore as reference. Maybe someone could do this for us. The Plugins, their usage and each needed modification of existing files are explained in the attached README file. Please let us know if you need help to get things running or if you have any suggestions. Regards Alex and Dario

12 years, 3 months

1
0
0 0

Introductions and small plugin

by Edwin Smulders

Hello everyone, You've seen me around for the past two weeks, and I thought I might introduce myself. My name's Edwin and I've just started working on my masters thesis (University of Twente, The Netherlands) and internship. I'm doing research into user space memory forensics, and at this moment volatility seems like the best tool to use for my research. Last week I wrote a small plugin to get familiar with the framework, it's available at [1]. I'll leave it up to you if it is useful enough to include in volatility. Currently I'm finalizing the approach to my research. Is it ok to use this list (or vol-users) if I have any ideas or questions related to my research that I need to bounce off of somebody? If it isn't taking too much time away from my thesis, I also plan to enter my research into the contest[2]. I hope that asking questions here still makes me eligible :) Cheers, Edwin [1] https://gist.github.com/Dutchy-/348cf96f56ea35e2b893 [2] http://volatility-labs.blogspot.nl/2013/01/the-1st-annual-volatility-framew…

12 years, 3 months

2
1
0 0

Automated and generic Android app analysis in Volatility

by Alex Joss

Hi all, We (Alex Joss and Dario Schwab) worked on a set of Volatility plugins for a generic and automated analysis of Android apps that we would like to share with you. This work resulted from our bachelor thesis at Security Engineering Lab of Bern University of Applied Sciences in Switzerland. For now, this is just a proof of concept and it will be developed further in the future. Our approach is based on the dalvik-plugins from Holger Macht, published to this mailing list on 2012-10-16. Our plugins are the following: - android_find_class_instances (scans the heap of the app) - android_app_generic (analyses the contents of the found objects) There are a few more files which have to be added or modified. Under the following link you will find the complete Volatility 2.3-alpha framework with our plugins and modifications already intergrated: https://dl.dropbox.com/u/12931232/volatility-2.3-devel-android.zip Unfortunately we can't provide a patch set, because our work's based on Volatility 2.3-alpha, which can't be downloaded anymore as reference. Maybe someone could do this for us. The Plugins, their usage and each needed modification of existing files are explained in the attached README file. Please let us know if you need help to get things running or if you have any suggestions. Regards Alex and Dario

12 years, 3 months

1
0
0 0

Contribution

by Joel Anderson

Hello Volatility Devs, I'm currently a student in a Digital Forensics class. We have used your wonderful tool to do memory dumps. We now have a project to contribute to an open source project. I was wondering if there was anything that I could contribute to the Volatility project. My strong point isn't in programming, but I have had an introduction to it. I don't know if there's any documentation you'd like to have updated, or whatever. I look forward to a response. Warm Regards, *Joel Anderson* Brigham Young University - April 2014 Masters of Information Systems Management (208) 570-7253

12 years, 3 months

2
1
0 0

2.3 and dumpfiles

by McCash John-GKJN37

Hey Guys, I've been waiting patiently while drooling for the new 2.3 release since October. I have several old cases where all I have is a memory image, and I'd like to be able to go back and dump out the registry hive files for manual examination. I keep checking back, but there's still no sign of dumpfiles being committed to the source repository. Does anyone have a good idea of when 2.3 is really likely to come out, and whether dumpfiles will actually be included? If it's not coming soon, would there be any chance of getting a prerelease copy for testing? I'd be happy to send back debug info for any cases where it's broken. Thanks much John McCash

12 years, 4 months

3
2
0 0

linux_tmpfs plugin

by Sebastien Bourdon-Richard

Hi, I am looking at the linux_tmpfs plugin and have a problem that I think is related to Windows. The problem happens when I try to extract tmpfs files. I'm not a python programmer but it seems to be related to str vs the String module. If I patch tmpfs.py and I convert the "String" module into str, everything works as expected: new_file = os.path.join(parent, *str(name)*) ( https://code.google.com/p/volatility/source/browse/trunk/volatility/plugins… ) Here's my error with tmpfs.py r3097: H:\Volatility\Volatility2.3SVN-3070>python vol.py -f Evo4GRodeo.lime --profile=LinuxEvo4Gx86 linux_tmpfs -S 1 -D app-cache Volatile Systems Volatility Framework 2.3_alpha WARNING : volatility.obj : Overlay structure tty_struct not present in vtypes WARNING : volatility.obj : Overlay structure cpuinfo_x86 not present in vtypes Traceback (most recent call last): File "vol.py", line 186, in <module> main() File "vol.py", line 177, in main command.execute() File "H:\Volatility\Volatility2.3SVN-3070\volatility\plugins\linux\common.py", line 57, in execute commands.Command.execute(self, *args, **kwargs) File "H:\Volatility\Volatility2.3SVN-3070\volatility\commands.py", line 111, in execute func(outfd, data) File "H:\Volatility\Volatility2.3SVN-3070\volatility\plugins\linux\tmpfs.py", line 177, in render_text for (i, path) in data: File "H:\Volatility\Volatility2.3SVN-3070\volatility\plugins\linux\tmpfs.py", line 160, in calculate self.walk_sb(root_dentry) File "H:\Volatility\Volatility2.3SVN-3070\volatility\plugins\linux\tmpfs.py", line 108, in walk_sb self.process_directory(root_dentry, parent = cur_dir) File "H:\Volatility\Volatility2.3SVN-3070\volatility\plugins\linux\tmpfs.py", line 72, in process_directory new_file = os.path.join(parent, name) File "H:\Python27\lib\ntpath.py", line 73, in join elif isabs(b): File "H:\Python27\lib\ntpath.py", line 57, in isabs s = splitdrive(s)[1] File "H:\Python27\lib\ntpath.py", line 125, in splitdrive if p[1:2] == ':': TypeError: 'String' object has no attribute '__getitem__' Is there something I can do to correct the problem from my side or should I open an issue on google code? Regards, Sebastien

12 years, 4 months

2
1
0 0

Announcing the First Annual Volatility Framework Plugin Contest

by Andrew Case

Hello All, We were writing to announce the first annual Volatility framework plugin writing contest: http://volatility-labs.blogspot.com/2013/01/the-1st-annual-volatility-frame… This contest is modeled after the well-known Hex-Rays plugin contest, and we hope to attract the same level of high-quality submissions as seen in the IDA contests. To the winners we offer a variety of cash prizes, recognition, and a chance to speak at our yearly conference. If you have any questions or comments please contact me directly or use the contact information listed in the blog post. Thanks, Andrew

12 years, 5 months

1
0
0 0

Announcing the next public offering of malware and memory forensics training by Volatility developers

by Andrew Case

Hello, We were writing to announce that the next public offering of Windows malware and memory forensics training by Volatility developers has been set for March 18-22rd in Chicago. Full details can be found here: http://volatility-labs.blogspot.com/2013/01/windows-malware-and-memory-fore… If you have any questions or comments then please contact me directly or use the information listed on the blog post. Thanks, Andrew (@attrc)

12 years, 5 months

1
0
0 0

DalvikVM support for Volatility

by Holger Macht

Hi, I've uploaded a tarball [1] containing a number of Volatility plugins which provide support for the DalvikVM and Android. I didn't provide a patch set, because there are only new files included. However, I can do so or can open an issue, whatever would be most convenient. The plugins are named: - dalvik_find_gdvm_offset - dalvik_vms - dalvik_loaded_classes - dalvik_class_information - dalvik_find_class_instance - dalvik_app_mirrored Any comments would be appreciated. This is part of a research project I need to have finished by the end of the year, so if someone suggests fundamental changes, I most likely won't have the immediate time to look at it. Just wanted to provide my code, because obviously there is some interest (cf. vol-users@). Ideally, I could get a branch in SVN to get this integrated into upcoming Volatility releases. I've attached a README.dalvik which gives some meta information about the plugins and could become a corresponding wiki article. Thanks to Joe Sylve and Andrew Case for providing me with some initial guidelines. Regards, Holger [1] http://www.homac.de/files/Volatility-Dalvik-support-v1.tar.bz2

12 years, 5 months

2
2
0 0

Windows 7 x64 _KTHREAD structure

by Cutter 409

I've noticed that on an unpatched Windows 7 x64 SP1 machine, the _KTHREAD structure ends as follows: +350 ThreadCounters : Ptr64 _KTHREAD_COUNTERS +358 XSaveState : Ptr64 _XSAVE_STATE On a version of the machine that is up to date on patches, I see _KTHREAD ending like this: +350 ThreadCounters : Ptr64 _KTHREAD_COUNTERS +358 StateSaveArea : Ptr64 _XSAVE_FORMAT +360 XSaveState : Ptr64 _XSAVE_STATE The result is that fields in the _ETHREAD structure are shifted by 8 bytes. on the patched machine. I can't be certain that it was a Microsoft Update (I'm only assuming), but does anyone know which patch causes the update? At the very least, is there a good method for detecting if a memory image uses one version of KTHREAD or the other? Any information would be helpful. Thanks!

12 years, 6 months

2
1
0 0

The Volatility Framework is now available in FreeBSD ports tree

by Sofian Brabez

Hi list, I'm pleased to announce you the Volatility Framework is now available in FreeBSD ports tree in security/py-volatility [1] since tonight. It was possible with efforts of Antoine Brodin and Sofian Brabez. Just make -C /usr/ports/security/py-volatility install clean, then try it with vol.py and a random dump. $ vol.py imageinfo -f /tmp/memory.dmp Volatile Systems Volatility Framework 2.2 Determining profile based on KDBG search... Suggested Profile(s) : Win7SP0x86, Win7SP1x86 AS Layer1 : JKIA32PagedMemoryPae (Kernel AS) AS Layer2 : FileAddressSpace (/tmp/memory.dmp) PAE type : PAE DTB : 0x185000L KDBG : 0x82948c28 Number of Processors : 1 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0x82949c00 KUSER_SHARED_DATA : 0xffdf0000 Image date and time : 2012-05-28 02:57:03 UTC+0000 Image local date and time : 2012-05-27 22:57:03 -0400 Regards -- Sofian Brabez

12 years, 6 months

2
1
0 0

Announcing memory forensics training directly from Volatility developers!

by Andrew Case

Hello, We are writing to announce the public offering of our Windows Memory Forensics for Analysts training course. This course is taught directly by Volatility developers, and will provide intense training in memory forensics for incident response, malware analysis, and digital forensic investigation. Full details can be found here: http://volatility-labs.blogspot.com/2012/11/windows-memory-forensics-traini… Please write or comment on the post if you have any questions or comments. Thanks, Andrew (@attrc)

12 years, 7 months

1
0
0 0

Extracting page tables from linux

by Nhan Ho

Hello, I'm currently in need of extracting page tables from a Linux memory image (with a known profile). Can anyone point me in the direction of Volatility's code that would handle the page tables ? Thanks, Nhan

12 years, 7 months

1
1
0 0

Development opportunities

by fuchee vang

Hi, I'm a forensics developer hoping to help out with this project. Let me know if you have anything that needs working on and hopefully I can contribute to this great open source project. Thanks. Regards, Fuchee Vang

12 years, 8 months

2
1
0 0

RE: problem analyzing dump from MacOSX 12.1.0.x86_64 (Make that 10.8. 12.1.0 is the kernel version)

by McCash John-GKJN37

Hi all, Make that OS X 10.8 (Mountain Lion). 12.1.0 is the kernel version. My apologies. I don't use Macs a lot, and 10.8 doesn't appear in the uname -a output for some unknown reason. John From: McCash John-GKJN37 Sent: Tuesday, August 28, 2012 4:34 PM To: 'vol-dev(a)volatilityfoundation.org' Subject: problem analyzing dump from MacOSX 12.1.0.x86_64 Hi, I've got to beg some help again. After finally getting Volatility for Linux to work, I procured a Mac mini to test Volatility in that space. I've carefully followed the instructions at http://code.google.com/p/volatility/wiki/MacMemoryForensics to create a profile file named 12.1.0.64bit.zip, which I placed in the volatility/plugins/overlays/mac folder. When I use the -info option in volatility, I see the profile as Mac12_1_0_64bitx64, so it's getting that far. However when I try to actually analyze an 8GB dump (dumped using MacMemoryreader_3.0.2) from the same Mac mini that I used to generate the profile, I get the following issues: $ python ./vol.py mac_machine_info --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 WARNING : volatility.obj : Deprecation warning: A plugin is making use of profile.add_types Major Version: - Minor Version: - Memory Size: - Max CPUs: - Physical CPUs: - Logical CPUs: - $ python ./vol.py mac_dmesg --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 WARNING : volatility.obj : Deprecation warning: A plugin is making use of profile.add_types Traceback (most recent call last): File "./vol.py", line 185, in <module> main() File "./vol.py", line 176, in main command.execute() File "/home/Forensic/mac_Volatility/mac-trunk/volatility/commands.py", line 111, in execute func(outfd, data) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/mac/mac_dmesg.py", line 57, in render_text for buf in data: File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/mac/mac_dmesg.py", line 41, in calculate if bufc[bufx] == 0 and bufc[0] != 0: TypeError: string indices must be integers, not NoneObject $ python ./vol.py imageinfo --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 Determining profile based on KDBG search... Traceback (most recent call last): File "./vol.py", line 185, in <module> main() File "./vol.py", line 176, in main command.execute() File "/home/Forensic/mac_Volatility/mac-trunk/volatility/commands.py", line 111, in execute func(outfd, data) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/imageinfo.py", line 34, in render_text for k, v in data: File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/imageinfo.py", line 44, in calculate suglist = [ s for s, _ in kdbgscan.KDBGScan.calculate(self)] File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/kdbgscan.py", line 112, in calculate proflens[p] = str(obj.VolMagic(buf).KDBGHeader) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/obj.py", line 743, in __getattr__ return self.m(attr) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/obj.py", line 725, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct VOLATILITY_MAGIC has no member KDBGHeader Does anyone know what may be going on here? Thanks John P.S. Here's my -info output: $ python ./vol.py --info Volatile Systems Volatility Framework 2.1_rc3 Scanner Checks -------------- CheckHiveSig - Check for a registry hive signature CheckPoolIndex - Checks the pool index CheckPoolSize - Check pool block size CheckPoolType - Check the pool type CheckProcess - Check sanity of _EPROCESS CheckSocketCreateTime - Check that _ADDRESS_OBJECT.CreateTime makes sense CheckThreads - Check sanity of _ETHREAD KPCRScannerCheck - Checks the self referential pointers to find KPCRs MultiPrefixFinderCheck - Checks for multiple strings per page, finishing at the offset MultiStringFinderCheck - Checks for multiple strings per page PoolTagCheck - This scanner checks for the occurance of a pool tag Address Spaces -------------- AMD64PagedMemory - Standard AMD 64-bit address space. ArmAddressSpace - No docs FileAddressSpace - This is a direct file AS. IA32PagedMemory - Legacy x86 non PAE address space (to use specify --use_old_as) IA32PagedMemoryPae - Legacy x86 PAE address space (to use specify --use_old_as) JKIA32PagedMemory - Standard x86 32 bit non PAE address space. JKIA32PagedMemoryPae - Standard x86 32 bit PAE address space. LimeAddressSpace - Address space for Lime MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader WindowsCrashDumpSpace32 - This AS supports windows Crash Dump format WindowsCrashDumpSpace64 - This AS supports windows Crash Dump format WindowsHiberFileSpace32 - This is a hibernate address space for windows hibernation files. Profiles -------- LinuxDebian2632x86 - A Profile for Linux Debian2632 x86 Mac12_1_0_64bitx64 - A Profile for Mac 12.1.0.64bit x64 Macmac_profilex64 - A Profile for Mac mac_profile x64 VistaSP0x64 - A Profile for Windows Vista SP0 x64 VistaSP0x86 - A Profile for Windows Vista SP0 x86 VistaSP1x64 - A Profile for Windows Vista SP1 x64 VistaSP1x86 - A Profile for Windows Vista SP1 x86 VistaSP2x64 - A Profile for Windows Vista SP2 x64 VistaSP2x86 - A Profile for Windows Vista SP2 x86 Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 Win7SP0x64 - A Profile for Windows 7 SP0 x64 Win7SP0x86 - A Profile for Windows 7 SP0 x86 Win7SP1x64 - A Profile for Windows 7 SP1 x64 Win7SP1x86 - A Profile for Windows 7 SP1 x86 WinXPSP1x64 - A Profile for Windows XP SP1 x64 WinXPSP2x64 - A Profile for Windows XP SP2 x64 WinXPSP2x86 - A Profile for Windows XP SP2 x86 WinXPSP3x86 - A Profile for Windows XP SP3 x86 Plugins ------- apihooks - Detect API hooks in process and kernel memory bioskbd - Reads the keyboard buffer from Real Mode memory callbacks - Print system-wide notification routines cmdscan - Extract command history by scanning for _COMMAND_HISTORY connections - Print list of open connections [Windows XP and 2003 Only] connscan - Scan Physical memory for _TCPT_OBJECT objects (tcp connections) consoles - Extract command history by scanning for _CONSOLE_INFORMATION crashinfo - Dump crash-dump information devicetree - Show device tree dlldump - Dump DLLs from a process address space dlllist - Print list of loaded dlls for each process driverirp - Driver IRP hook detection driverscan - Scan for driver objects _DRIVER_OBJECT envars - Display process environment variables filescan - Scan Physical memory for _FILE_OBJECT pool allocations gdt - Display Global Descriptor Table getsids - Print the SIDs owning each process handles - Print list of open handles for each process hashdump - Dumps passwords hashes (LM/NTLM) from memory hibinfo - Dump hibernation file information hivedump - Prints out a hive hivelist - Print list of registry hives. hivescan - Scan Physical memory for _CMHIVE objects (registry hives) idt - Display Interrupt Descriptor Table imagecopy - Copies a physical address space out as a raw DD image imageinfo - Identify information for the image impscan - Scan for calls to imported functions kdbgscan - Search for and dump potential KDBG values kpcrscan - Search for and dump potential KPCR values ldrmodules - Detect unlinked DLLs linux_arp - Print the ARP table linux_cpuinfo - Prints info about each active processor linux_dmesg - Gather dmesg buffer linux_dump_map - No docs linux_ifconfig - Gathers active interfaces linux_iomem - Provides output similar to /proc/iomem linux_lsmod - Gather loaded kernel modules linux_lsof - Lists open files linux_memmap - Dumps the memory map for linux tasks. linux_mount - Gather mounted fs/devices linux_netstat - Lists open sockets linux_proc_maps - gathers process maps for linux linux_psaux - gathers processes along with full command line and start time linux_pslist - Gather active tasks by walking the task_struct->task list linux_route_cache - Lists routing table lsadump - Dump (decrypted) LSA secrets from the registry mac_arp - prints the arp table mac_dmesg - prints the kernel debug buffer mac_get_processors - No docs mac_ifconfig - No docs mac_ip_filters - No docs mac_list_open_files - No docs mac_lsmod - No docs mac_machine_info - No docs mac_mount - No docs mac_netstat - No docs mac_notifiers - detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_proc_maps - No docs mac_psaux - No docs mac_pslist - No docs mac_route - No docs mac_runq - No docs mac_trustedbsd - No docs mac_version - No docs mac_vfs_events - No docs mac_wait_queues - No docs malfind - Find hidden and injected code memdump - Dump the addressable memory for a process memmap - Print the memory map moddump - Dump a kernel driver to an executable file sample modscan - Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects modules - Print list of loaded modules mutantscan - Scan for mutant objects _KMUTANT netscan - Scan a Vista, 2008 or Windows 7 image for connections and sockets patcher - Patches memory based on page scans printkey - Print a registry key, and its subkeys and values procexedump - Dump a process to an executable file sample procmemdump - Dump a process to an executable memory sample pslist - print all running processes by following the EPROCESS lists psscan - Scan Physical memory for _EPROCESS pool allocations pstree - Print process list as a tree psxview - Find hidden processes with various process listings raw2dmp - Converts a physical memory sample to a windbg crash dump shimcache - Parses the Application Compatibility Shim Cache registry key sockets - Print list of open sockets sockscan - Scan Physical memory for _ADDRESS_OBJECT objects (tcp sockets) ssdt - Display SSDT entries strings - Match physical offsets to virtual addresses (may take a while, VERY verbose) svcscan - Scan for Windows services symlinkscan - Scan for symbolic link objects thrdscan - Scan physical memory for _ETHREAD objects threads - Investigate _ETHREAD and _KTHREADs timers - Print kernel timers and associated module DPCs userassist - Print userassist registry keys and information vaddump - Dumps out the vad sections to a file vadinfo - Dump the VAD info vadtree - Walk the VAD tree and display in tree format vadwalk - Walk the VAD tree volshell - Shell in the memory image yarascan - Scan process or kernel memory with Yara signatures

12 years, 9 months

2
1
0 0

problem analyzing dump from MacOSX 12.1.0.x86_64

by McCash John-GKJN37

Hi, I've got to beg some help again. After finally getting Volatility for Linux to work, I procured a Mac mini to test Volatility in that space. I've carefully followed the instructions at http://code.google.com/p/volatility/wiki/MacMemoryForensics to create a profile file named 12.1.0.64bit.zip, which I placed in the volatility/plugins/overlays/mac folder. When I use the -info option in volatility, I see the profile as Mac12_1_0_64bitx64, so it's getting that far. However when I try to actually analyze an 8GB dump (dumped using MacMemoryreader_3.0.2) from the same Mac mini that I used to generate the profile, I get the following issues: $ python ./vol.py mac_machine_info --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 WARNING : volatility.obj : Deprecation warning: A plugin is making use of profile.add_types Major Version: - Minor Version: - Memory Size: - Max CPUs: - Physical CPUs: - Logical CPUs: - $ python ./vol.py mac_dmesg --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 WARNING : volatility.obj : Deprecation warning: A plugin is making use of profile.add_types Traceback (most recent call last): File "./vol.py", line 185, in <module> main() File "./vol.py", line 176, in main command.execute() File "/home/Forensic/mac_Volatility/mac-trunk/volatility/commands.py", line 111, in execute func(outfd, data) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/mac/mac_dmesg.py", line 57, in render_text for buf in data: File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/mac/mac_dmesg.py", line 41, in calculate if bufc[bufx] == 0 and bufc[0] != 0: TypeError: string indices must be integers, not NoneObject $ python ./vol.py imageinfo --profile=Mac12_1_0_64bitx64 -f /cygdrive/g/Mac* Volatile Systems Volatility Framework 2.1_rc3 Determining profile based on KDBG search... Traceback (most recent call last): File "./vol.py", line 185, in <module> main() File "./vol.py", line 176, in main command.execute() File "/home/Forensic/mac_Volatility/mac-trunk/volatility/commands.py", line 111, in execute func(outfd, data) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/imageinfo.py", line 34, in render_text for k, v in data: File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/imageinfo.py", line 44, in calculate suglist = [ s for s, _ in kdbgscan.KDBGScan.calculate(self)] File "/home/Forensic/mac_Volatility/mac-trunk/volatility/plugins/kdbgscan.py", line 112, in calculate proflens[p] = str(obj.VolMagic(buf).KDBGHeader) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/obj.py", line 743, in __getattr__ return self.m(attr) File "/home/Forensic/mac_Volatility/mac-trunk/volatility/obj.py", line 725, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct VOLATILITY_MAGIC has no member KDBGHeader Does anyone know what may be going on here? Thanks John P.S. Here's my -info output: $ python ./vol.py --info Volatile Systems Volatility Framework 2.1_rc3 Scanner Checks -------------- CheckHiveSig - Check for a registry hive signature CheckPoolIndex - Checks the pool index CheckPoolSize - Check pool block size CheckPoolType - Check the pool type CheckProcess - Check sanity of _EPROCESS CheckSocketCreateTime - Check that _ADDRESS_OBJECT.CreateTime makes sense CheckThreads - Check sanity of _ETHREAD KPCRScannerCheck - Checks the self referential pointers to find KPCRs MultiPrefixFinderCheck - Checks for multiple strings per page, finishing at the offset MultiStringFinderCheck - Checks for multiple strings per page PoolTagCheck - This scanner checks for the occurance of a pool tag Address Spaces -------------- AMD64PagedMemory - Standard AMD 64-bit address space. ArmAddressSpace - No docs FileAddressSpace - This is a direct file AS. IA32PagedMemory - Legacy x86 non PAE address space (to use specify --use_old_as) IA32PagedMemoryPae - Legacy x86 PAE address space (to use specify --use_old_as) JKIA32PagedMemory - Standard x86 32 bit non PAE address space. JKIA32PagedMemoryPae - Standard x86 32 bit PAE address space. LimeAddressSpace - Address space for Lime MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader WindowsCrashDumpSpace32 - This AS supports windows Crash Dump format WindowsCrashDumpSpace64 - This AS supports windows Crash Dump format WindowsHiberFileSpace32 - This is a hibernate address space for windows hibernation files. Profiles -------- LinuxDebian2632x86 - A Profile for Linux Debian2632 x86 Mac12_1_0_64bitx64 - A Profile for Mac 12.1.0.64bit x64 Macmac_profilex64 - A Profile for Mac mac_profile x64 VistaSP0x64 - A Profile for Windows Vista SP0 x64 VistaSP0x86 - A Profile for Windows Vista SP0 x86 VistaSP1x64 - A Profile for Windows Vista SP1 x64 VistaSP1x86 - A Profile for Windows Vista SP1 x86 VistaSP2x64 - A Profile for Windows Vista SP2 x64 VistaSP2x86 - A Profile for Windows Vista SP2 x86 Win2003SP0x86 - A Profile for Windows 2003 SP0 x86 Win2003SP1x64 - A Profile for Windows 2003 SP1 x64 Win2003SP1x86 - A Profile for Windows 2003 SP1 x86 Win2003SP2x64 - A Profile for Windows 2003 SP2 x64 Win2003SP2x86 - A Profile for Windows 2003 SP2 x86 Win2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64 Win2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64 Win2008SP1x64 - A Profile for Windows 2008 SP1 x64 Win2008SP1x86 - A Profile for Windows 2008 SP1 x86 Win2008SP2x64 - A Profile for Windows 2008 SP2 x64 Win2008SP2x86 - A Profile for Windows 2008 SP2 x86 Win7SP0x64 - A Profile for Windows 7 SP0 x64 Win7SP0x86 - A Profile for Windows 7 SP0 x86 Win7SP1x64 - A Profile for Windows 7 SP1 x64 Win7SP1x86 - A Profile for Windows 7 SP1 x86 WinXPSP1x64 - A Profile for Windows XP SP1 x64 WinXPSP2x64 - A Profile for Windows XP SP2 x64 WinXPSP2x86 - A Profile for Windows XP SP2 x86 WinXPSP3x86 - A Profile for Windows XP SP3 x86 Plugins ------- apihooks - Detect API hooks in process and kernel memory bioskbd - Reads the keyboard buffer from Real Mode memory callbacks - Print system-wide notification routines cmdscan - Extract command history by scanning for _COMMAND_HISTORY connections - Print list of open connections [Windows XP and 2003 Only] connscan - Scan Physical memory for _TCPT_OBJECT objects (tcp connections) consoles - Extract command history by scanning for _CONSOLE_INFORMATION crashinfo - Dump crash-dump information devicetree - Show device tree dlldump - Dump DLLs from a process address space dlllist - Print list of loaded dlls for each process driverirp - Driver IRP hook detection driverscan - Scan for driver objects _DRIVER_OBJECT envars - Display process environment variables filescan - Scan Physical memory for _FILE_OBJECT pool allocations gdt - Display Global Descriptor Table getsids - Print the SIDs owning each process handles - Print list of open handles for each process hashdump - Dumps passwords hashes (LM/NTLM) from memory hibinfo - Dump hibernation file information hivedump - Prints out a hive hivelist - Print list of registry hives. hivescan - Scan Physical memory for _CMHIVE objects (registry hives) idt - Display Interrupt Descriptor Table imagecopy - Copies a physical address space out as a raw DD image imageinfo - Identify information for the image impscan - Scan for calls to imported functions kdbgscan - Search for and dump potential KDBG values kpcrscan - Search for and dump potential KPCR values ldrmodules - Detect unlinked DLLs linux_arp - Print the ARP table linux_cpuinfo - Prints info about each active processor linux_dmesg - Gather dmesg buffer linux_dump_map - No docs linux_ifconfig - Gathers active interfaces linux_iomem - Provides output similar to /proc/iomem linux_lsmod - Gather loaded kernel modules linux_lsof - Lists open files linux_memmap - Dumps the memory map for linux tasks. linux_mount - Gather mounted fs/devices linux_netstat - Lists open sockets linux_proc_maps - gathers process maps for linux linux_psaux - gathers processes along with full command line and start time linux_pslist - Gather active tasks by walking the task_struct->task list linux_route_cache - Lists routing table lsadump - Dump (decrypted) LSA secrets from the registry mac_arp - prints the arp table mac_dmesg - prints the kernel debug buffer mac_get_processors - No docs mac_ifconfig - No docs mac_ip_filters - No docs mac_list_open_files - No docs mac_lsmod - No docs mac_machine_info - No docs mac_mount - No docs mac_netstat - No docs mac_notifiers - detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_proc_maps - No docs mac_psaux - No docs mac_pslist - No docs mac_route - No docs mac_runq - No docs mac_trustedbsd - No docs mac_version - No docs mac_vfs_events - No docs mac_wait_queues - No docs malfind - Find hidden and injected code memdump - Dump the addressable memory for a process memmap - Print the memory map moddump - Dump a kernel driver to an executable file sample modscan - Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects modules - Print list of loaded modules mutantscan - Scan for mutant objects _KMUTANT netscan - Scan a Vista, 2008 or Windows 7 image for connections and sockets patcher - Patches memory based on page scans printkey - Print a registry key, and its subkeys and values procexedump - Dump a process to an executable file sample procmemdump - Dump a process to an executable memory sample pslist - print all running processes by following the EPROCESS lists psscan - Scan Physical memory for _EPROCESS pool allocations pstree - Print process list as a tree psxview - Find hidden processes with various process listings raw2dmp - Converts a physical memory sample to a windbg crash dump shimcache - Parses the Application Compatibility Shim Cache registry key sockets - Print list of open sockets sockscan - Scan Physical memory for _ADDRESS_OBJECT objects (tcp sockets) ssdt - Display SSDT entries strings - Match physical offsets to virtual addresses (may take a while, VERY verbose) svcscan - Scan for Windows services symlinkscan - Scan for symbolic link objects thrdscan - Scan physical memory for _ETHREAD objects threads - Investigate _ETHREAD and _KTHREADs timers - Print kernel timers and associated module DPCs userassist - Print userassist registry keys and information vaddump - Dumps out the vad sections to a file vadinfo - Dump the VAD info vadtree - Walk the VAD tree and display in tree format vadwalk - Walk the VAD tree volshell - Shell in the memory image yarascan - Scan process or kernel memory with Yara signatures

12 years, 9 months

1
0
0 0

RE: My Mistakes & Documentation Suggestions

by McCash John-GKJN37

Hi Folks, Thanks tons to Mike Auty, Andrew Case, Joe Sylve, Andrew DiMino, Michael Cohen, and Jamie Levy, I'm now up and running with Volatility for Linux. I did want to mention a couple of things that I ran into problems with. It's possible we might want for some related items to be more prominent in the documentation. 1. While the -h option output does include the line, "--info Print information about all registered objects", it still wasn't immediately clear to me that this option would list available profiles. In fact, I somehow managed to miss the existence of --info entirely. It might be useful to actually include the list of available profiles in the -h output. Alternatively, maybe we could move -info in the -h output closer to the top, & specifically mention that it will list available profiles? 2. It wasn't clear to me initially that to define a profile, you drop an appropriately named .zip file with appropriate contents into volatility/plugins. It's still not entirely clear, as from some of my reading it looks like you're supposed to put the profile file into volatility/plugins/overlays/<ostype> instead. I'm guessing both probably work, though I haven't tested. I suspect one is legacy or something. You might want to append a notation to the -profile line in the -h output to, "see the tools/<ostype>/README file for details on profile creation", and then spell this out a little more clearly there, including how the profile name is constructed, based on the name of the zip file. 3. I ran into a problem using the specific zip command listed in the tools/linux/README file, "zip Distro.zip module.dwarf /boot/System.map-2.6.32-8-generic". This creates a zip file with a boot subfolder containing the System.map file, which didn't work in my testing. I had to copy the System.map file to the current folder and then zip up the two files. 4. The linux wiki document is out of date, but I imagine you already knew that. It should refer to the linux-trunk branch instead of the scudette branch. It also doesn't say where to put the .zip file to create a profile, how the name of the new profile is created, based on the .zip file name, or how to get a list of available profiles. Thanks again John

12 years, 10 months

1
0
0 0

RE: Problem with Linux Volatility

by McCash John-GKJN37

Response anyone? I can't believe this would really be this broken, so I have to be doing something wrong (or maybe not... see below). I first tried this with r2149, and have checked a couple of the more recent updates, I but get the same result. Are the wiki<http://code.google.com/p/volatility/wiki/LinuxMemoryForensics> instructions I'm following maybe out-of-date? Looking further, I tried this with -dubug, and got: ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer > /home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility/plugins/addrspaces/mmap_address_space.py(67)__init__() -> access=mmap.ACCESS_READ) Then looked at line 67 in mmap_address_space.py, and see: # On 64 bit architectures we can just map the entire image # into our process. TODO(scudette): Try to make this work on # 32 bit systems by segmenting into several smallish maps. self.map = mmap.mmap(self.fhandle.fileno(), self.fsize, access=mmap.ACCESS_READ) So, assuming the above TODO comment related to the issue I'm seeing; Is it because I'm running volatility on a 32bit system, or because I'm trying to analyze a dump from a 32bit system? Thanks John From: McCash John-GKJN37 Sent: Tuesday, August 07, 2012 2:12 PM To: 'vol-dev(a)volatilityfoundation.org' Subject: Problem with Linux Volatility Hi Folks, Sorry you only seem to hear from me about once a year, but I got fired up over Joe's & Andrew's Forensic Summit presentations and resolved to try out the new stuff in the Linux & Mac branches. Unfortunately I don't seem to have gotten very far with it. I've got the scudette branch installed on a SIFT Kit VM, and have successfully used LiME to dump memory from it. I've also successfully created a profile for the SIFT Kit's 2.6.31-23-generic kernel, using json I successfully dumped from module_dwarf.ko. I even tried the live /dev/pmem memory interface you get when you load up the pmem.ko module. When I attempt to run Volatility , here's what happens... root@SIFT-Workstation:~/Desktop/linux_Volatility/lin64-support# python vol.py The Volatility Memory Forensic Framework technology preview (3.0_tp1). NOTE: This is pre-release software and is provided for evauation only. Please check at http://volatility.googlecode.com/ for officially supported versions. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License. >>> session.filename = "/dev/pmem" >>> session.profile_file = "myprofile.zip" >>> session.profile = "Linux32" >>> vol (plugins.pslist) ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer ERROR:root:Failed running plugin pslist: kernel_address_space not specified. ERROR:root:Error: 'NoneType' object has no attribute 'name' Traceback (most recent call last): File "<console>", line 1, in <module> File "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility/session.py", line 292, in vol self.last = super(InteractiveSession, self).vol(*args, **kwargs) File "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility/session.py", line 154, in vol ui_renderer.start(plugin_name=result.name, kwargs=kwargs) AttributeError: 'NoneType' object has no attribute 'name' >>> Am I doing something brain-damaged? Thanks John

12 years, 10 months

5
7
0 0

Problem with Linux Volatility

by McCash John-GKJN37

Hi Folks, Sorry you only seem to hear from me about once a year, but I got fired up over Joe's & Andrew's Forensic Summit presentations and resolved to try out the new stuff in the Linux & Mac branches. Unfortunately I don't seem to have gotten very far with it. I've got the scudette branch installed on a SIFT Kit VM, and have successfully used LiME to dump memory from it. I've also successfully created a profile for the SIFT Kit's 2.6.31-23-generic kernel, using json I successfully dumped from module_dwarf.ko. I even tried the live /dev/pmem memory interface you get when you load up the pmem.ko module. When I attempt to run Volatility , here's what happens... root@SIFT-Workstation:~/Desktop/linux_Volatility/lin64-support# python vol.py The Volatility Memory Forensic Framework technology preview (3.0_tp1). NOTE: This is pre-release software and is provided for evauation only. Please check at http://volatility.googlecode.com/ for officially supported versions. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License. >>> session.filename = "/dev/pmem" >>> session.profile_file = "myprofile.zip" >>> session.profile = "Linux32" >>> vol (plugins.pslist) ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer ERROR:root:Failed running plugin pslist: kernel_address_space not specified. ERROR:root:Error: 'NoneType' object has no attribute 'name' Traceback (most recent call last): File "<console>", line 1, in <module> File "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility/session.py", line 292, in vol self.last = super(InteractiveSession, self).vol(*args, **kwargs) File "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility/session.py", line 154, in vol ui_renderer.start(plugin_name=result.name, kwargs=kwargs) AttributeError: 'NoneType' object has no attribute 'name' >>> Am I doing something brain-damaged? Thanks John

12 years, 10 months

2
1
0 0

JSON format for apihooks and malfind

by Thorsten Sick

Hi I just added JSON output for malfind and apihooks. See: http://code.google.com/p/volatility/issues/detail?id=305 Do you need anything else from me to get it merged upstream ? Wishes ? Thorsten Sick -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com

12 years, 11 months

1
0
0 0

Volatility 2.1 RC1 is available

by Michael Hale Ligh

Hey everyone, The 2.1 RC1 downloads are now available [1]. Per the usual, there are zip and tar archives of the source code, a windows module installer, and a standalone windows executable (with python and all dependencies build-in). We ask that you test vigorously over the next 2 weeks, especially with any x64 images, and let us know via the issue tracker [2] if you run into any bugs. At the end of July, we'll announce the official release of 2.1. Also, a lot of the documentation [3] has been updated, including the FAQ, command reference, features by plugin matrix, and roadmap, so that may be a useful resource to you when using 2.1. Thank you very much! [1]. http://code.google.com/p/volatility/downloads/list [2]. http://code.google.com/p/volatility/issues/list [3]. http://code.google.com/p/volatility/w/list

12 years, 11 months

2
3
0 0

JSON output for threads

by Thorsten Sick

Hi I modified threads to also create JSON output (diff and sample attached to bug). http://code.google.com/p/volatility/issues/detail?id=289 Everyone who is interested in this kind of features please check the code and give some feedback. Thanks Thorsten Sick -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com

12 years, 11 months

2
3
0 0

ITES and logformat

by Thorsten Sick

Hello My name is Thorsten Sick, I am Researcher at Avira. Currently I am part of the ITES project. This project's aim is to develop detection/protection technology using the benefits from a guest system running in a virtual machine. Short: Sensors in the VM and in the hypervisor layer. One of my first steps would be to automate Malware analysis and use some big guns. Volatility would be a big gun. Combined with cuckoobox it could be very powerful. But for that volatility needs: - A log format that could be parsed in a simple way (JSON ?) for the plugins - Maybe some nice API to control it from Cuckoobox I am ready to implement that. But before doing stuff only half I would love to hear your opinion. Especially if you have some whishes what exactly should be in those logs, please tell me. If you maintain a plugin, please tell me. I am ready to write the log code or we try to figure out a format and you can code it yourself. What I am doing here should have benefits for the community-if done right. You can also find me in the IRC. Thanks Thorsten -- Thorsten Sick, Research Avira Operations GmbH & Co. KG Kaplaneiweg 1 88069 Tettnang Germany Phone: +49 7542-500 0 Fax: +49 7542-500 3000 Internet: http://www.avira.com

12 years, 11 months

2
2
0 0

Uploading changes to the trunk

by Michael Felber

Hello all, I have applied a small change to the output file name of malfind.py but Tortiose seems not to be willing to upload it. Error: Unallowed method. How can I upload the code using Tortoise SVN?? CU Mic

12 years, 12 months

2
1
0 0

vtop and 5GB 64bit memory dump problem

by Sebastien Bourdon-Richard

Hi, I'm playing with a 5GB Windows 7 SP0 64bit memory dump and I have some problems with processes mapped over 4GB. Pslist only shows System process. Maybe it's because System is the only process mapped under 4GB? H:\Volatility>python vol.py -f Windows Seven.vmem --profile=Win7SP0x64 pslist Volatile Systems Volatility Framework 2.1_alpha Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ -------------------- -------------------- 0xfffffa8005355b30 System 4 0 91 -------- ------ 0 2012-06-14 19:42:15 H:\Volatility>python vol.py -f Windows Seven.vmem --profile=Win7SP0x64 psscan Volatile Systems Volatility Framework 2.1_alpha Offset(P) Name PID PPID PDB Time created Time exited ------------------ ---------------- ------ ------ ------------------ -------------------- -------------------- 0x0000000008755b30 System 4 0 0x0000000000187000 2012-06-14 19:42:15 0x0000000174a4a800 VMwareTray.exe 2028 1164 0x000000018c7c3000 2012-06-14 19:42:47 0x0000000174a55b30 VMwareUser.exe 1324 1164 0x000000018af49000 2012-06-14 19:42:47 0x0000000174a923f0 SearchIndexer. 240 552 0x000000018895a000 2012-06-14 19:42:53 0x0000000174aebb30 SearchFilterHo 2108 240 0x0000000188146000 2012-06-14 19:42:54 0x0000000174b00060 SearchProtocol 2076 240 0x00000001964b2000 2012-06-14 19:42:54 0x0000000174db7630 explorer.exe 1164 1976 0x000000019a477000 2012-06-14 19:42:46 0x0000000174f52b30 vmtoolsd.exe 1392 552 0x0000000190f88000 2012-06-14 19:42:39 0x0000000175015060 svchost.exe 316 552 0x000000019bdd9000 2012-06-14 19:42:33 0x0000000175021b30 spoolsv.exe 1088 552 0x00000001a2a65000 2012-06-14 19:42:38 0x00000001750fb060 svchost.exe 816 552 0x0000000196cde000 2012-06-14 19:42:36 0x0000000175241060 svchost.exe 900 552 0x00000001a020e000 2012-06-14 19:42:29 0x0000000175276060 svchost.exe 828 552 0x00000001a6621000 2012-06-14 19:42:29 0x000000017528c060 audiodg.exe 968 828 0x000000019ddc2000 2012-06-14 19:42:32 0x0000000175294630 VMUpgradeHelpe 1460 552 0x000000019f527000 2012-06-14 19:42:40 0x00000001752b8b30 svchost.exe 1284 552 0x0000000192402000 2012-06-14 19:42:39 0x000000017531b9b0 taskhost.exe 1936 552 0x000000019a163000 2012-06-14 19:42:45 0x000000017531c880 dwm.exe 2008 868 0x000000019b4fc000 2012-06-14 19:42:46 0x000000017538a5f0 svchost.exe 1136 552 0x00000001a3870000 2012-06-14 19:42:38 0x0000000175517b30 csrss.exe 364 356 0x000000000032c000 2012-06-14 19:42:22 0x0000000175521060 svchost.exe 668 552 0x00000001a2b4d000 2012-06-14 19:42:27 0x000000017554bb30 wininit.exe 436 356 0x00000000be0b2000 2012-06-14 19:42:24 0x0000000175553b30 csrss.exe 460 448 0x00000000be284000 2012-06-14 19:42:24 0x0000000175592960 winlogon.exe 504 448 0x00000000bff4a000 2012-06-14 19:42:24 0x00000001755bf060 svchost.exe 744 552 0x00000001a1251000 2012-06-14 19:42:28 0x00000001755d1b30 services.exe 552 436 0x00000001a7184000 2012-06-14 19:42:25 0x00000001755d8060 svchost.exe 868 552 0x00000001a0309000 2012-06-14 19:42:29 0x00000001755e2b30 lsass.exe 560 436 0x00000001a9128000 2012-06-14 19:42:25 0x00000001755e6910 lsm.exe 568 436 0x00000001a9470000 2012-06-14 19:42:25 0x0000000175deb060 userinit.exe 1976 504 0x000000019b3ee000 2012-06-14 19:42:45 0x0000000176263b30 WmiPrvSE.exe 1848 668 0x00000001a8947000 2012-06-14 19:42:45 0x00000001763ff950 smss.exe 264 4 0x0000000041470000 2012-06-14 19:42:15 Does the problem can be related to the vtop function in amd64? For a physical page size of 4KB, vtop() in amd64.py convert the address: 1- get pml4e 2- get pdpte 3- get pde 4- get pte 5- return get_phys_addr The function get_phys_addr() in step #5 is in intel.py and is 32bit only: def get_phys_addr(self, vaddr, pte_value): return (pte_value & 0xfffff000) | (vaddr & 0xfff) If the pte_value is 64bit, it get cuts in the get_phys_addr()? Thanks for your help, Sébastien

13 years

3
2
0 0

Volatility Linux Support

by Joe Sylve

I'm having trouble getting the linux support branch working. I followed all the directions found here: https://code.google.com/p/volatility/wiki/LinuxMemoryForensics I just can't seem to get it to work. Here's what I'm getting: joe@zuul:~/volatility/lin64-support$ python vol.py Welcome to volshell! To get help, type 'help()' >>> session.filename = "/home/joe/dump" Traceback (most recent call last): File "<console>", line 1, in <module> NameError: name 'session' is not defined Can anyone help me with this, or point me to a download for the older linux branch, which was previously working for me? Thank you very much. -- Joe Sylve, M.S. Senior Security Researcher GIAC Certified Forensics Analyst (GCFA) Digital Forensics Solutions, LLC http://www.digitalforensicssolutions.com/

13 years, 1 month

2
7
0 0

Error with new packetscan module

by Mike Pilkington

Hi, I'm playing with the new packetscan.py module from issue 233: http://code.google.com/p/volatility/issues/detail?id=233 I'm using it against a Windows XP SP2 image and get the following error: $ volatility packetscan -f IR-XP-PC-20120302-memdump.mem --no-cache Traceback (most recent call last): File "/usr/local/bin/volatility", line 135, in <module> main() File "/usr/local/bin/volatility", line 126, in main command.execute() File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 101, in execute func(outfd, data) File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/packetscan.py", line 100, in render_text for source, dest in data: File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/packetscan.py", line 91, in calculate profile.vtypes.update(ippkt_vtype) AttributeError: 'WinXPSP2x86' object has no attribute 'vtypes' Does this module not support XP SP2? I'm admittedly in over my head, but I'm trying to figure out how to create a plugin to scan memory for a particular signature, and when found, parse data following the signature at specified offsets. I was examining this module as a possible template for my own module. I'm wondering, is it recommended to create a new vtype when scanning for a structure in memory? Thanks, Mike

13 years, 2 months

3
4
0 0

Upcoming version of volatility

by Michael Cohen

Hi All, As you may be aware I have been working on the new upcoming version of volatility. It has been a massive cleanup of the code base and a rewrite of much of the underlying architecture. The main thrust of this release is the development of a framework, which can easily be integrated into other tools as a library. This mean removing all globals, removing command line flags and removing any automated magical stuff that happens behind the scenes. Redesign of the object model so its more consistent with a library, and style cleanup of the codebase to improve its quality. The following is the summary of the main architectural changes: - Domain specific profiles. The profiles are no longer associated with the address spaces. You can have any number of profiles alive at the same time (e.g. kernel space and user space). Profiles are simply templates for instantiating CTypes on an address space. Therefore a profile is not specifically tied into a particular address space in any way. This also removes the obj_vm/native_vm confusion for dereferencing across address spaces, as address space switching is now done explicitly. - Removal of VolatilityMagic - there are basically two use cases for these - the first is just a profile specific constant, and the second is the automated running of code to retrieve a value (e.g. kdbg scan). Constants are now parts of the profile itself (for example in linux the system map is stored as profile constants), and automated code running is removed in favor of explicit plugin execution (which is made easier now). - The plugin architecture is updated - Previously it was very hard to share code between plugins - this is now very simple. For example, any plugin can call any other plugin. Plugins also export more intelligent functions than calculate() - so they can be used as modules themselves. Plugins are now also selectable according to the profile - for example we have a linux "pslist" and a windows "pslist", so just calling plugins.pslist() will get the right module depending on the selected profile. - The registry code is updated to remove automatic importation of files. This allows for much simpler and more efficient packaging as core modules are referenced directly. Loading of external plugins can now be done via a Load() plugin. This architecture is better for use in a framework. - The main user interface is based on ipython. This makes the user interface much easier to use - with command line completion helping users throughout. Users can also run arbitrary code on the results and we now can have light weight extension scripts - without needing to write a proper plugin. http://code.google.com/p/volatility/wiki/ScudettesBranch has some information about the new interface, but I will post a screencast soon that shows more. - Style cleanups. This refactor cleans up the style. In particular issues such as lines over 80 chars and legacy calls to base class methods (i.e. not using super) are cleaned up. - The new release includes memory acquisition tools as well as linux support. What should we do about it? The current version is a major rewrite of the current code base - it is not a patch to the current codebase and retrofitting it would be too difficult. We need to port the existing modules to the new code base and clean up this code. All developers need to consider the changes present in this version and how they apply to the next volatility release. If people have general architectural suggestions/disagreements etc we need to resolve these now. We then need to create a new volatility 3.0 branch and complete the porting of the modules to it. I have made a spreadsheet to document what modules are converted to the new framework and which are not done yet: https://docs.google.com/spreadsheet/ccc?key=0Athc84IflFGbdHpGcmNjWFkycFN4Q0… I am making slow progress on porting the code over to the new code base. I am happy with the way things are looking, and the new code is looking very nice. If people want to help, please let me know and I will provide editing rights and you can put your name next to each item to take ownership. I suggest all major new development to go to this branch (such as new modules etc). I am looking to complete a release candidate in the next month or two, as there is really not that much left to do. I will be running a workshop at DFRWS about volatility and will want to have the new release definitely out by then. Thanks, Michael.

13 years, 2 months

1
0
0 0

Memory analysis of a process

by Akash Kulkarni

Hi, I want to do memory analysis for a single process running in the memory. Is this possible with "Volatility" ? I am calling this executable file from a perl script. Now when this executable file will get loaded in the memory, I want to see how much memory it consumes. Furthermore, I want to plot a graph for this executable process against memory consumed by the executable file (for it's entire life cycle). This is very important since I need to compare three different tools against their memory requirement. Thanks in advance. Regards, Akash.

13 years, 3 months

3
2
0 0

pagefile.sys integration suggestion

by Anton Ovchinnikov

Hi guys! Do you have any plans concerning pagefile.sys integration into Volatility? Memory dump and pagefile joint analysis would be helpful and could help with reconstructing the image of all running processes and the whole system itself, don't you think so? Btw, thank you all for the great framework! -- Thanks, Anton

13 years, 4 months

1
0
0 0

Coming soon to a volatility near you....

by Michael Cohen

Hi Guys, I just wanted to send a quick email to let you know of where the scudette branch is heading in the near future. The main goal of development is to create a volatility library that can be easily used from external programs, and also to make it far easier for people to use volatility and in particular automate it through simple scripts (without needing to necessarily write a plugin). The idea is to extend volshell to make it THE way to use volatility. These are the major goals: - Get rid of the caching system - its not needed if we run everything from inside volshell since command instances can just do their own caching if they need it. - Separate the concept of a profile from the address space - currently the address space carries the profile (as.profile) but really has nothing to do with it. In the new implementation the config object carries both address spaces, and profiles. The refactor removes the global obj.Object() factory and instead moves this factory to the profile - this strengthen the relation between the profile and objects it create (i.e. it is the profile which actually creates the object instances on a given address space.). - Remove all the magic around the place - currently when I want to do a pslist, it automatically does a scan behind the scenes, which may or may not work. The new architecture removes automatic behind the scene actions, and requires the user to explicitely set them. If a command requires a value for KDBG offset, this must be provided (i.e. the user will scan for it first, then provide the correct value). Since all this happens in the shell we dont really have a high startup time each time - so the user can just try the first result from the scan themselves (this is what happens now anyway but if the first his is incorrect things break badly without users knowing what to do next). - The current VOLATILITY_MAGIC member of the profile will go into a constants attribute of the profile. This is essentially the same as the linux profile's idea of a smap (the system symbol map). It also makes it much more intuitive for the user that they can just get profile specific constants by getting profile.constants["KDBGHeader"]. Automatic code executing by the volatility magic will disappear as I mentioned. - The new system automatically exports all command modules as volshell commands (which return the instance). This makes it easy to call different command plugins from inside the shell - with no additional startup time (profile parsing etc). Also since we return a handle to the command plugin, it can export all its useful methods for people to use. For example: class PSList(....) def list_tasks(self): """ A generator over all the tasks.""" def render_text(self): for task in self.list_tasks(): ... pretty print in a table... There is no longer confusion over exactly what kind of data calculate() returns since it does not really matter (The calculate method for all plugins will be renamed something more suggestive of its function). In the shell one simply does: for task in pslist().list_tasks(): print task.comm or: pslist().render() or: pslist().render_text() To see the old output. Also in the new code the name of the command plugin is unrelated to the class name, so you can have multiple implementations of pslist which are selected based on the profile. (e.g. a windows pslist and a linux pslist). In the volshell, launching pslist, will pick the right one. In addition to this we will no longer have complex and brittle inheritence structure for commands. Currently we inherit from a command if we need to use one of its methods (e.g. dlllist, pslist, moddump etc all share the same base class because they all need to list tasks!). This will simply not be necessary since any module could easily call any other module through a global command factory - so for getting moddump to get a process list, a plugin can just do: for task in self.RunModule("pslist"): .... without needing to be inherited from pslist directly. Also inside volshell (if you use ipython) we can easily run scripts. For example this is one of my scripts to find the current process (i.e. python) task struct in memory (This is intended to run on /dev/pmem): import os for task in pslist().list_tasks(): if os.getpid() == task.pid: print "My task is at 0x%X (pid %s)" % (task.obj_offset, task.pid) break Then from ipython I can run this script in the context of the shell: In [2]: run -i /home/mic/test.py My task is at 0xFFFF880013C1AE40 (pid 1315) and in the end the variable "task" will contain my own task. If I still want a pretty printed table: pslist().render_text() An added bonus is that I can use ipython's awesome double tab expansion to see all the members of task: In [2]: task. (tab-tab) Display all 200 possibilities? (y or n) task._CType__initialized task.bio_list task.io_context task.__class__ task.blocked task.ioac task.__delattr__ task.btrace_seq task.irqaction task.__dict__ task.cast task.is_valid .... This is an awesome interactive experience for volatility. Thanks, Michael.

13 years, 5 months

1
0
0 0

Looking for Eoghan Casey's cmd_history.py Volatility plugin

by McCash John-GKJN37

Hi Folks, I was recently trying to dig up a quick, easy method for parsing Windows commandline history records out of memory dumps, and came across a reference to Eoghan Casey's 2010 article. Extracting Windows command line details from physical memory. When I pinged him about the cmd_history.py Volatility plugin he wrote along with that paper, he said he'd sent it in to the Volatility development group, and had presumed it would be included at some point. I've been digging around, but I can't find it. Any idea what happened to it? Thanks John ---------------------------------------------------------- Quis custodiet ipsos custodes?... I do!

13 years, 8 months

3
3
0 0

Trouble with forensic1394 III

by Michael Felber

It seems that Volatility uses a I/O packet size that's to large for my system. Thanks to Freddie Witherden for supporting me. Using a small dumping application (see below) provided by Freddie I was successfully able to dump that 2GiB of RAM. So I transferred this thread to vol-dev. CU Michael

13 years, 10 months

2
1
0 0

Trouble with forensic1394 III

by Michael Felber

Hello all, to test if the I/O packet size is the only problem I have adapted ieee1394.py in that way: def read(self, addr, length): """Lowering packet size""" self._device.request_size = 1024 """Reads bytes from the specified address""" return self._device.read(addr, length) So there's no I/O error reported by forensic 1394 anymore but the data seems to be not mappable: # python vol.py -l firewire://forensic1394/0 pslist Volatile Systems Volatility Framework 2.1_alpha No suitable address space mapping found Tried to open image as: ... FirewireAddressSpace: Must be first Address Space FileAddressSpace: Must be first Address Space I have no clue what went wrong. Any help appreciated... CU Michael -- NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie! Jetzt informieren: http://www.gmx.net/de/go/freephone

13 years, 10 months

1
0
0 0

small dumping application provided by Freddie Witherden

by Michael Felber

# Simple dumping application from forensic1394 import Bus from time import sleep b = Bus() # Enable SBP-2 support for access to Linux/Windows targets b.enable_sbp2() # Sleep to give the bus time to reinitialise sleep(2.0) # Attempt to open the first attached device d = b.devices()[0] d.open() # If this fails, try reducing the request size d._request_size = 512 f = open('memorydump','wb') for addr in range(1*1024*1024,2*1024*1024*1024,1*1024*1024): data = d.read(addr, 1*1024*1024) f.write(data

13 years, 10 months

1
0
0 0

feature request: Support of GraphViz-dot-format for pssscan

by Michael Felber

Hello Folks, Although already written in the vol-users list this thread belongs to the vol-dev one: in 1.4rc1 there was a nice feature to visualize the output of psscan in the GraphViz-dot-format with -output=dot. I have used it frequently to explain memory structures to non IT-Experts or for training purposes. Is it possible to add this feature to Version 2.0 again, please? Many thanks in advance! Michael

13 years, 10 months

1
0
0 0

Re: [Vol-dev] A doubt about vista_sp0_x86_vtypes.py

by Jamie Levy

neofito, I thought that you might like to know that we have just committed profiles for Vista SP1 and SP2. Would you like to test them out on your Vista images? Let us know if you have any problems. All the best, -gleeda > Date: Wed, 26 Jan 2011 19:25:49 +0100 > From: neofito <vjaviergarcia(a)ono.com> > Subject: Re: [Vol-dev] A doubt about vista_sp0_x86_vtypes.py > To: vol-dev(a)volatilityfoundation.org > Message-ID: <4D40672D.9010200(a)ono.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > The current Vista profile is working well, it was just a doubt > > Thanks > > > El 20/01/2011 7:37, AAron Walters escribió: >> >> >> neofito, >> >> I would guess that is the file that Bradley was interested in when he >> generated the profile. If you would prefer to use types from >> ntkrpamp.pdb, please feel free. With all the changes in the upcoming >> 1.4, adding new types and profiles has become a lot easier. Hopefully >> you will also decide to submit them back and assist with Vista testing. >> >> Have you run into problems with the current profile? Is it not working? >> Thanks, >> >> AW >>

14 years, 4 months

2
1
0 0

A doubt about vista_sp0_x86_vtypes.py

by neofito

Hello, From "Windows Internals, Fifth Edition": On 32-bit x86 systems, the flag in the page table entry to mark a page as nonexecutable is available only when processor is running in Physical Address Extension (PAE) mode. Thus, support for hardware DEP on 32-bit systems requires loading the PAE kernel Why the file used is ntkrnlmp.pdb instead of ntkrpamp.pdb? Thanks, --- La verdad nos hara libres http://neosysforensics.blogspot.com http://www.wadalbertia.org -<|:-P[G]

14 years, 4 months

3
5
0 0

New memory profile and kpcrscan question

by neofito

First, I'm not a spammer, I promise :) Following the instructions provided by Bradley Schatz [1] I added a new profile for Windows Vista SP2. since the code is actively revised it's obvious that not all commands work how is expected, but I'm very surprised that the command kpcrscan always get the same value: C:\Volatility-1.4_rc1>volatility.py --profile=VistaSP2x86 -f vistasp2.dmp kpcrscan Volatile Systems Volatility Framework 1.4_rc1 Potential KPCR structure virtual addresses: Phys addr 00150000 Virt addr ffdff000 _KPCR: ffdff000 obviously this is not correct 0: kd> !pcr KPCR for Processor 0 at 81d45800: Major 1 Minor 1 NtTib.ExceptionList: ffffffff NtTib.StackBase: 00000000 NtTib.StackLimit: 00000000 NtTib.SubSystemTib: 80151000 NtTib.Version: 001d39f9 NtTib.UserPointer: 00000001 NtTib.SelfTib: 00000000 SelfPcr: 81d45800 Prcb: 81d45920 Irql: 00000002 IRR: 00000000 IDR: ffffffff InterruptMode: 00000000 IDT: 81bff400 GDT: 81bff000 TSS: 80151000 CurrentThread: 81d49640 NextThread: 00000000 IdleThread: 81d49640 DpcQueue: The volatility code version is the latest available via subversion (r493). [1] http://blog.schatzforensic.com.au/2010/05/adding-new-structure-definitions-… --- La verdad nos hara libres http://neosysforensics.blogspot.com http://www.wadalbertia.org -<|:-P[G]

14 years, 8 months

3
2
0 0

Adding kernel version / distro generic Linux support to Volatility (long email & code)

by Andrew Case

Hello, With quite a bit of help & patience from ikelos, I have created a skeleton for generic Linux support for Vol. In order to show the complete process of how it currently works, I am going to demonstrate the process from start to finish (a simple process listing of a memory image). The main reason I am sending this email is because I hope that the volatility developers can review what I have so far, comment, and ultimately we can finalize a skeleton that can then be rapidly added on to develop tens of useful plugins for Linux memory analysis. I already have code for quite a bit of kernel analysis, so my whole goal of this is to fit it inside the framework and ultimately get it accepted into Volatility stable. So the process of my system currently works like this (will be illustrated with code and examples after): 1) Gather all of the structure offsets from a kernel through an LKM 2) Feed the LKM's output to a python script that generates a vtype / profile automatically based on structure definitions kept in another file 3) Make a profile python file for these types 4) Now we have a profile for the specific type and plugins can use it as normal after this point we can run plugins, so now to illustrate all of this: 1) Gathering of offsets is facilitated in this LKM. (I added a simple license & author header to each file due to ikelos's advice to do so) http://gist.github.com/595600 This module works by gathering the offset of members from every structure necessary to do analysis. It also adds the size of each structure into the output file in order to have correct profile information. Note that this code is kernel version aware and will be able to get offsets from any 2.6.x version. Also, it only gathers a small number of structures & members now b/c that is all that is needed in order to list processes. Once the code is reviewed by devs, other structures can be quickly added. 2) Feed this 1) to a python script So at this step we need to generate the profile and we also need to set the DTB. Even though it may seem odd, its not possible in a 2.6.x generic way to get the cr3/dtb of the init process in order to automatically acquite the dtb, even inside the kernel module. This is because the DTB we want (swapper_pg_dir) is not exported and the mm structure that references it (init_mm) stopped being exported in 2.6.26. Also, you can't get a reference to init_mm through init_task, because after initialize init_task->mm is set to NULL. Because of all this, we have to accept the DTB value on the commandline to this script, but this is easily obtained by grepping for 'swapper_pg_dir' in the corresponding System.map file for the kernel. Here is the python script to generate the output, note that the linux_kernel_types file will take work as well to support all structures & members needed for full analysis, but that it will be stable for all of 2.6.x once set: http://gist.github.com/595589 http://gist.github.com/595598 Here is using it on the test kernel: http://gist.github.com/595594 as you can see it has all the kernel structures and uses volatility_magic to store the DTB. This means the users never have to deal with DTB and it will still with the profile forever and will auto load on vol initialization now that we have this: 3) make a simple python profile With the help of ikelos, I have made the profile system very easy to add support for new kernel versions. To support this there is an abstract Linux Profile that does everything but set the abstract_types: http://gist.github.com/595604 and the simple profile needed to support the debian test image: http://gist.github.com/595606 4) time to write a plugin! this is the simple plugin I came up with to list processes & it uses profile just generated: http://gist.github.com/595607 note that the system map parsing stuff will go into a utility file once devs approve of the current way of doing things or we change stuff around. its very quick to parse so its not an issue to parse it on every load or eventually have the system map hash table pickled in the cache With that, we have distro / version generic Linux support. We also have an easy method to generate profiles for any Linux System. Please send any comments / suggestions, as once its approved I would like to quickly add support for a large number of more plugins & kernels

14 years, 9 months

2
3
0 0

Follow up to Linux support (read other email first) - a number of discussion points.....

by Andrew Case

I didn't want to put this in the last email as it wasn't exactly related. I currently see two (non-technical) issue with full blown Linux support. 1) Since there are now 36 stable 2.6.x kernel versions and ten or so distros, even partial coverage will require a huge amount of profiles. While its easy to install a bunch of distros & kernels in a VM and get profiles for them, the big problem will be how to allow users to choose what profile is right without overwhelming them with options. It is no where near as simple as Windows with relatively few versions compared to Linux. 2) Going off 1), there is also the problem of how to name all the profiles and the eventual --profile option. Since distros have multiple kernels packaged for the same kernel version its not as simple as what I have now (LinuxDebian2626) because debian has multiple 2626 packages, that will all have different offsets, dtb, and such. So we need to come up with a sane method of allowing all the profiles to be choosen. What I was thinking for this is a complete reorder of the --help system, which honestly is confusing now. Since vol will now have windows & linux support, and (soon ;)) will have support for some specific applications memory analysis, I think the help menu should be something like this (close to what svn does) python volatility -h Windows python volality -h Linux python volatility -h some_app and then it will show you only the plugins for whichever os/app you are interested in. This can be made simple inside the current framework, by tagging each plugin with what they support inside of the string message. so for instance you can have: class some_linux_plugin(...): ''' Linux - A module for linux process listing ''' class some_windows_plugin(...): ''' Windows - A module for windows process listing ''' and this way only the stuff after - gets displayed and the parser knows what plugins work on which apps. for plugins that work regardless of OS there could be a "-h any" option or similar... 3) To help with profile explosion, there also should be some way to list profiles for a specific app/os and for linux, which distro: as of right now, the only way I know of to get a list of profiles is with --info, which also lists a bunch of other stuff. If there was a way to do something like: python volalitility.py --list-profiles Windows which wouuld return all windows profiles or --list-profiles Windows XP which would return profiles for windows xp similarly for linux you could have: --list-profiles Linux --list-profiles Linux Debian which would greatly help if we are going to properly support Linux & all the different distros and versions Even without Linux support, this issue will crop up as volality moves to support XP (with 3 service packs), vista (with 2 currently), 7, 2008, 2003, etc as relying on --info will just result in huge blocks of text

14 years, 9 months

1
0
0 0

Fwd: [Vol-dev] Re: Vol-dev Digest, Vol 14, Issue 1

by Jamie Levy

Hi Jason, I think you sent this only to me by mistake :-) I'm forwarding this to the list so others can respond to you. As for other OS's it there's been some discussion related to this recently on the users list you can check out too: http://lists.volatilityfoundation.org/pipermail/vol-users/2010-January/thre… But yes, you should be able to extend Volatility to include other OS's. All the best, -Jamie ---------- Forwarded message ---------- From: Jason Reynolds <JReynolds(a)pathwayforensics.com> Date: Wed, Jan 6, 2010 at 5:13 PM Subject: RE: [Vol-dev] Re: Vol-dev Digest, Vol 14, Issue 1 To: Jamie Levy <jamie.levy(a)gmail.com> Hi All, A similar question to John's, but also a little different -- Is there a place where the format of ram allocation and DTB's are documented, or is the best documentation simply disassembling the associated operating system? I am curious to know if additional OS's could be easily added to volatility. If there is sufficient documentation on the OS it should be relatively simple to write a parser. Thanks in advance.

15 years, 5 months

1
0
0 0

Re: Vol-dev Digest, Vol 14, Issue 1

by Jamie Levy

Hi John, You can check out the entire branch like so: svn checkout http://volatility.googlecode.com/svn/branches/Volatility-1.4_beta1/ volatility All the best, -Jamie > Date: Wed, 6 Jan 2010 09:02:15 -0500 > From: "McCash John-GKJN37" <john.mccash(a)motorola.com> > Subject: RE: [Vol-dev] Possible Volatility Bug > To: "Mike Auty" <mike.auty(a)gmail.com> > Cc: vol-dev(a)volatilityfoundation.org > Message-ID: > <D8DFDF3C534B344B9A266EB03CC828BB049270A3(a)de01exm71.ds.mot.com> > Content-Type: text/plain; charset="us-ascii" > > Mike, > I'm running the version pulled from SVN this morning, 1.3.1 > (08.09.2009). How would I list the candidate DTB addresses? The way I > found out about this problem originally was to just email Peter the > error from memorize. He instantly recognized the problem. Also, how > would I get the 1.4 branch to try out? Apologies for the dumb questions. > I'm reasonably bright, but I only use this thing about once every four > months. > Thanks lots > John

15 years, 5 months

1
0
0 0

RE: [Vol-dev] Possible Volatility Bug

by McCash John-GKJN37

Mike, I'm running the version pulled from SVN this morning, 1.3.1 (08.09.2009). How would I list the candidate DTB addresses? The way I found out about this problem originally was to just email Peter the error from memorize. He instantly recognized the problem. Also, how would I get the 1.4 branch to try out? Apologies for the dumb questions. I'm reasonably bright, but I only use this thing about once every four months. Thanks lots John -----Original Message----- From: Mike Auty [mailto:mike.auty@gmail.com] Sent: Wednesday, January 06, 2010 7:48 AM To: McCash John-GKJN37 Subject: Re: [Vol-dev] Possible Volatility Bug Hiya John, First off could you please specify which version of volatility you're using (whether you're using a tarball, or the sources from subversion)? Also, whilst I can't comment too well on the 1.3 branch, I don't think Windows 2003 is supported, I believe it's mostly aimed at XP SP2. Having said that, it is possible to manually specify a DTB in the 1.4 branch using --dtb and in the 1.3 branch using -b (although for 1.3 this is probably plugin dependent). I'll leave it to someone who's been working with Volatility longer to give you a more in-depth answer once you let us know which version you were using, but hopefully this'll let you work around the problem for a bit... 5:) Mike 5:)

15 years, 5 months

2
1
0 0

New versions & new features

by McCash John-GKJN37

Hey Folks, I was just reading Gleeda's blog & CEIC presentation, and was interested to discover that Volatility modules had been written for Linux and Vista. Now I'm wondering why these modules haven't shown up anywhere I can see them, including in the public view of the SVN repository. After digging for a bit, I did see that they (or at least a modified version of the Linux ones) have apparently been incorporated into the Pyflag distribution, but that just caused me more confusion. If they're stable enough to release as part of Pyflag, why aren't they in the public Volatility repository? Also, are you expecting to release an 'official' update anytime soon? The last update available from the main Volatility page is still 1.3_Beta. Is there some defined list of fixes or features that has to be ready before an 'official' 1.3 version is released? Or has that been bypassed, so that current work is really going toward 1.4? Maybe a roadmap section would make a good addition to the main Volatility page. I'm sure there are a lot of people who would be interested in what's going on. Thanks much (Sorry if I sound like I'm ranting, you guys really have done some awesome work!) John ---------------------------------------------------------- Quis custodiet ipsos custodes?... I do!

15 years, 5 months

3
3
0 0

New On this list

by Jason Reynolds

Hi! I'm new to this list but I'd like to help on a few parts of the PE parsing apparati. I will be reviewing the source this week. Is there any objection to a -v (verbose) flag which would output offsets to header references to the specified objects to assist with manual image inspection? Typically I use automated tools to an extent, but another feature I'd like to add is actual PE extraction if the executable was fully loaded into memory (say the file self removes, or a rootkit lives only in RAM). This way we could plug things directly into objdump or another disassembler of choice (IDA Pro here). Thoughts? Suggestions? Regards, Jason Reynolds

15 years, 8 months

2
1
0 0

[patch] Support for block devices (such as iSCSI exported memory images)

by Mike Auty

Hiya guys, I had a request from echo6 to allow Volatility to run against iSCSI exported memory images (which basically show up in Linux as block devices). The attached patch changes checks from "not isfile" to "isdir", in order to include block files, regular files and symlinks. The patch also includes a secondary method for determine filesize, based on opening the file, seeking to the end, and then asking the file to tell how far the cursor is. That works fine for block devices, whereas getsize returns 0. As you can see form the patch, there's a lot of plugins that reimplement existing code and handle files directly. That also means that other existing plugins will need converting if they're to work against block devices... Mike 5:) diff --git a/trunk/Volatility/forensics/addrspace.py b/trunk/Volatility/forensics/addrspace.py index d0c0dee..c1d7198 100755 --- a/trunk/Volatility/forensics/addrspace.py +++ b/trunk/Volatility/forensics/addrspace.py @@ -43,6 +43,12 @@ class FileAddressSpace: self.name = fname self.fhandle = open(fname, mode) self.fsize = os.path.getsize(fname) + # getsize returns 0 for block devices + if self.fsize < 1: + f = open(fname, mode) + f.seek(0, os.SEEK_END) + self.fsize = f.tell() + f.close() if fast == True: self.fast_fhandle = open(fname, mode) diff --git a/trunk/Volatility/forensics/win32/scan.py b/trunk/Volatility/forensics/win32/scan.py index 3217983..771fe67 100644 --- a/trunk/Volatility/forensics/win32/scan.py +++ b/trunk/Volatility/forensics/win32/scan.py @@ -678,7 +678,6 @@ def connection_dump(address, cnt, object): def conn_scan(addr_space, types, filename, beg, end, slow): - if slow == False: connection_object = ScanObject(addr_space,types) connection_object.set_fast_beg(beg) diff --git a/trunk/Volatility/vmodules.py b/trunk/Volatility/vmodules.py index cd1bf20..5aa0cd1 100644 --- a/trunk/Volatility/vmodules.py +++ b/trunk/Volatility/vmodules.py @@ -978,7 +978,7 @@ def psscan(cmdname, argv): slow = opts.slow - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -993,6 +993,12 @@ def psscan(cmdname, argv): start = 0 filesize = os.path.getsize(filename) + # getsize returns 0 for block devices + if filesize < 1: + f = open(filename, 'rb') + f.seek(0, os.SEEK_END) + filesize = f.tell() + f.close() if not opts.end is None: try: @@ -1050,7 +1056,7 @@ def thrdscan(cmdname, argv): slow = opts.slow - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1065,6 +1071,12 @@ def thrdscan(cmdname, argv): start = 0 filesize = os.path.getsize(filename) + # getsize returns 0 for block devices + if filesize < 1: + f = open(filename, 'rb') + f.seek(0, os.SEEK_END) + filesize = f.tell() + f.close() if not opts.end is None: try: @@ -1123,7 +1135,7 @@ def sockscan(cmdname, argv): slow = opts.slow - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1138,6 +1150,12 @@ def sockscan(cmdname, argv): start = 0 filesize = os.path.getsize(filename) + # getsize returns 0 for block devices + if filesize < 1: + f = open(filename, 'rb') + f.seek(0, os.SEEK_END) + filesize = f.tell() + f.close() if not opts.end is None: try: @@ -1194,7 +1212,7 @@ def connscan(cmdname, argv): slow = opts.slow - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1209,6 +1227,12 @@ def connscan(cmdname, argv): start = 0 filesize = os.path.getsize(filename) + # getsize returns 0 for block devices + if filesize < 1: + f = open(filename, 'rb') + f.seek(0, os.SEEK_END) + filesize = f.tell() + f.close() if not opts.end is None: try: @@ -1257,7 +1281,7 @@ def mem_map(cmdname, argv): opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1354,7 +1378,7 @@ def modscan(cmdname, argv): slow = opts.slow - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1368,6 +1392,12 @@ def modscan(cmdname, argv): start = 0 filesize = os.path.getsize(filename) + # getsize returns 0 for block devices + if filesize < 1: + f = open(filename, 'rb') + f.seek(0, os.SEEK_END) + filesize = f.tell() + f.close() if not opts.end is None: try: @@ -1423,7 +1453,7 @@ def dump_chk(cmdname, argv): op = get_standard_parser(cmdname) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1492,7 +1522,7 @@ def mem_dump(cmdname, argv): opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1601,7 +1631,7 @@ def hibinfo(cmdname, argv): metavar="FILE", dest="dump") opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1923,7 +1953,7 @@ def connscan2(cmdname, argv): op = get_standard_parser(cmdname) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -1968,7 +1998,7 @@ def sockscan2(cmdname, argv): op = get_standard_parser(cmdname) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -2009,7 +2039,7 @@ def modscan2(cmdname, argv): op = get_standard_parser(cmdname) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -2049,7 +2079,7 @@ def thrdscan2(cmdname, argv): op = get_standard_parser(cmdname) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename @@ -2093,7 +2123,7 @@ def psscan2(cmdname, argv): action='store_true',dest='dot_format', default=False) opts, args = op.parse_args(argv) - if (opts.filename is None) or (not os.path.isfile(opts.filename)) : + if (opts.filename is None) or (os.path.isdir(opts.filename)) : op.error("File is required") else: filename = opts.filename

15 years, 8 months

3
4
0 0

[Patch] NewObject branch conversion of dlllist module to plugin

by Mike Auty

Hi everybody, Sorry for the patch spam, but here's a new dlllist. Absolutely no changes required to the framework for this one (the patch just includes clean-up of the old module code). So, it looks like everything's going according to plan! 5:) Mike 5:) >From 09832b06c751a06ccab5f7d4f850e7f18bcce279 Mon Sep 17 00:00:00 2001 From: Mike Auty <mike.auty(a)gmail.com> Date: Sat, 26 Sep 2009 23:47:36 +0100 Subject: [PATCH] Add in dlllist plugin. --- Volatility/forensics/win32/tasks.py | 55 --------- Volatility/memory_plugins/internal/dlls.py | 83 +++++++++++++ Volatility/vmodules.py | 176 +--------------------------- Volatility/volatility.py | 4 - 4 files changed, 86 insertions(+), 232 deletions(-) create mode 100644 Volatility/memory_plugins/internal/dlls.py diff --git a/Volatility/forensics/win32/tasks.py b/Volatility/forensics/win32/tasks.py index 8a64778..d78150b 100644 --- a/Volatility/forensics/win32/tasks.py +++ b/Volatility/forensics/win32/tasks.py @@ -248,18 +248,6 @@ def create_addr_space(kaddr_space, directory_table_base): return process_address_space -def process_command_line(process_address_space, types, peb_vaddr): - process_parameters = read_obj(process_address_space, types, - ['_PEB', 'ProcessParameters'], peb_vaddr) - - - if process_parameters is None: - return None - - return read_unicode_string(process_address_space, types, - ['_RTL_USER_PROCESS_PARAMETERS', 'CommandLine'], - process_parameters) - def peb_number_processors(process_address_space, types, peb_vaddr): return read_obj(process_address_space, types, ['_PEB', 'NumberOfProcessors'], peb_vaddr) @@ -279,49 +267,6 @@ def module_base(process_address_space, types, module_vaddr): return read_obj(process_address_space, types, ['_LDR_DATA_TABLE_ENTRY', 'DllBase'], module_vaddr) -def process_ldrs(process_address_space, types, peb_vaddr): - ldr = read_obj(process_address_space, types, - ['_PEB', 'Ldr'], peb_vaddr) - - module_list = [] - - if ldr is None: - print "Unable to read ldr for peb 0x%x" % (peb_vaddr) - return module_list - - first_module = read_obj(process_address_space, types, - ['_PEB_LDR_DATA', 'InLoadOrderModuleList', 'Flink'], - ldr) - - if first_module is None: - print "Unable to read first module for ldr 0x%x" % (ldr) - return module_list - - this_module = first_module - - next_module = read_obj(process_address_space, types, - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks', 'Flink'], - this_module) - - if next_module is None: - print "ModuleList Truncated, unable to read module at 0x%x\n" % (this_module) - return module_list - - while next_module != first_module: - module_list.append(this_module) - if not process_address_space.is_valid_address(next_module): - print "ModuleList Truncated, unable to read module at 0x%x\n" % (next_module) - return module_list - _prev_module = this_module - this_module = next_module - next_module = read_obj(process_address_space, types, - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks', 'Flink'], - this_module) - - - return module_list - - def find_csdversion(addr_space, types): CSDVersionDict = dict() diff --git a/Volatility/memory_plugins/internal/dlls.py b/Volatility/memory_plugins/internal/dlls.py new file mode 100644 index 0000000..277a6ca --- /dev/null +++ b/Volatility/memory_plugins/internal/dlls.py @@ -0,0 +1,83 @@ +''' +Created on 26 Sep 2009 + +@author: Mike Auty +''' + +#pylint: disable-msg=C0111 + +import forensics.commands +import forensics.win32 as win32 +import forensics.object2 as object2 +import forensics.utils as utils + +class dlllist(forensics.commands.command): + """Print list of loaded dlls for each process""" + + def __init__(self, args=None): + forensics.commands.command.__init__(self, args) + self.profile = None + + def parser(self): + """Sets up the parser before execution""" + forensics.commands.command.parser(self) + + self.op.add_option('-o', '--offset', + help='EPROCESS Offset (in hex) in physical address space', + action='store', type='string', dest='offset') + + self.op.add_option('-p', '--pid', + help='Get info for this Pid', default=None, + action='store', type='int', dest='pid') + + def render_text(self, outfd, data): + first = True + for pid in data: + if not first: + outfd.write("*" * 72 + "\n") + + task = data[pid]['task'] + outfd.write("%s pid: %-6d\n" % (task.ImageFileName, pid)) + first = False + + if task.Peb: + outfd.write("Command line : %s\n" % (task.Peb.ProcessParameters.CommandLine)) + outfd.write("%s\n" % task.Peb.CSDVersion) + outfd.write("\n") + modules = data[pid]['modules'] + outfd.write("%-12s %-12s %s\n" % ('Base', 'Size', 'Path')) + for m in modules: + outfd.write("0x%0.8x 0x%0.6x %s\n" % (int(m.BaseAddress), int(m.SizeOfImage), m.FullDllName)) + else: + outfd.write("Unable to read PEB for task.\n") + + def calculate(self): + result = {} + self.profile = object2.Profile() + + addr_space = utils.load_as(self.opts) + + if self.opts.offset: + try: + offset = int(self.opts.offset, 16) + except ValueError: + self.op.error("EPROCESS offset must be a hexadecimal number.") + + tasks = [object2.NewObject("_EPROCESS", offset, addr_space, profile=self.profile)] + + else: + tasks = win32.tasks.pslist(addr_space, self.profile) + + for task in tasks: + if task.UniqueProcessId: + pid = int(task.UniqueProcessId) + if self.opts.pid and pid != self.opts.pid: + continue + + result[pid] = {'task': task, 'modules': []} + + if task.Peb.Ldr.InLoadOrderModuleList: + for l in task.Peb.Ldr.InLoadOrderModuleList.list_of_type("_LDR_MODULE", "InLoadOrderModuleList"): + result[pid]['modules'].append(l) + + return result \ No newline at end of file diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index 2082b73..b4f583f 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -36,9 +36,9 @@ from vutils import get_standard_parser, is_hiberfil, is_crash_dump, types, get_d from forensics.addrspace import FileAddressSpace from forensics.win32.hiber_addrspace import WindowsHiberFileSpace32 from forensics.win32.crash_addrspace import WindowsCrashDumpSpace32 -from forensics.object import read_unicode_string, read_obj -from forensics.win32.tasks import module_base, module_path, module_size, create_addr_space, process_addr_space, process_command_line, process_dtb, process_find_pid -from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count +from forensics.object import read_obj +from forensics.win32.tasks import create_addr_space, process_addr_space, process_dtb, process_find_pid +from forensics.win32.tasks import process_imagename, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot from forensics.win32.handles import handle_entries, handle_process_id, handle_tables from forensics.win32.vad import vad_dump, vad_info, print_vad_dot_infix, print_vad_dot_prefix, print_vad_table, print_vad_tree, traverse_vad @@ -125,176 +125,6 @@ def get_pslist(cmdname, argv): create_time) ################################### -# dlllist - DLL list -################################### -def get_dlllist(cmdname, argv): - """ - Function prints a list of dlls loaded in each process - """ - op = get_standard_parser(cmdname) - - op.add_option('-o', '--offset', - help='EPROCESS Offset (in hex) in physical address space', - action='store', type='string', dest='offset') - op.add_option('-p', '--pid', - help='Get info for this Pid', - action='store', type='int', dest='pid') - - opts, _args = op.parse_args(argv) - - filename = opts.filename - - (addr_space, symtab, types) = load_and_identify_image(op, opts) - - if not opts.offset is None: - - try: - offset = int(opts.offset, 16) - except: - op.error("EPROCESS offset must be a hexadecimal number.") - - try: - flat_address_space = FileAddressSpace(filename) - except: - op.error("Unable to open image file %s" % (filename)) - - directory_table_base = process_dtb(flat_address_space, types, offset) - - process_address_space = create_addr_space(addr_space, directory_table_base) - - process_id = process_pid(flat_address_space, types, offset) - - if process_address_space is None: - print "Error obtaining address space for process [%d]" % (process_id) - return - - - image_file_name = process_imagename(flat_address_space, types, offset) - - print "%s pid: %d" % (image_file_name, process_id) - - peb = process_peb(flat_address_space, types, offset) - - if not process_address_space.is_valid_address(peb): - print "Unable to read PEB for task." - return - - command_line = process_command_line(process_address_space, types, peb) - - if command_line is None: - command_line = "UNKNOWN" - - print "Command line : %s" % (command_line) - - print - - modules = process_ldrs(process_address_space, types, peb) - - if len(modules) > 0: - print "%-12s %-12s %s" % ('Base', 'Size', 'Path') - - for module in modules: - if not process_address_space.is_valid_address(module): - return - path = module_path(process_address_space, types, module) - if path is None: - path = "%-10s " % ('UNKNOWN') - - base = module_base(process_address_space, types, module) - if base is None: - base = "%-10s " % ('UNKNOWN') - else: - base = "0x%-10x" % (base) - - size = module_size(process_address_space, types, module) - if size is None: - size = "%-10s " % ('UNKNOWN') - else: - size = "0x%-10x" % (size) - - print "%s %s %s" % (base, size, path) - - print - - else: - - # get list of windows processes - all_tasks = process_list(addr_space, types, symtab) - - if not opts.pid == None: - all_tasks = process_find_pid(addr_space, types, symtab, all_tasks, opts.pid) - if len(all_tasks) == 0: - print "Error process [%d] not found" % opts.pid - - star_line = '*'*72 - - for task in all_tasks: - - if not addr_space.is_valid_address(task): - continue - - if len(all_tasks) > 1: - print "%s" % star_line - - image_file_name = process_imagename(addr_space, types, task) - - process_id = process_pid(addr_space, types, task) - - - print "%s pid: %d" % (image_file_name, process_id) - - process_address_space = process_addr_space(addr_space, types, task, opts.filename) - if process_address_space is None: - print "Error obtaining address space for process [%d]" % (process_id) - continue - - peb = process_peb(addr_space, types, task) - - if not process_address_space.is_valid_address(peb): - print "Unable to read PEB for task." - continue - - command_line = process_command_line(process_address_space, types, peb) - - if command_line is None: - command_line = "UNKNOWN" - - print "Command line : %s" % (command_line) - - print read_unicode_string(process_address_space, types, - ['_PEB', 'CSDVersion'], peb) - - print - - modules = process_ldrs(process_address_space, types, peb) - - if len(modules) > 0: - print "%-12s %-12s %s" % ('Base', 'Size', 'Path') - - for module in modules: - if not process_address_space.is_valid_address(module): - continue - path = module_path(process_address_space, types, module) - if path is None: - path = "%-10s " % ('UNKNOWN') - - base = module_base(process_address_space, types, module) - if base is None: - base = "%-10s " % ('UNKNOWN') - else: - base = "0x%-10x" % (base) - - size = module_size(process_address_space, types, module) - if size is None: - size = "%-10s " % ('UNKNOWN') - else: - size = "0x%-10x" % (size) - - print "%s %s %s" % (base, size, path) - - print - -################################### # strings - identify pid(s) associated with a string ################################### def print_string(offset, pidlist, string): diff --git a/Volatility/volatility.py b/Volatility/volatility.py index baee253..ff50b51 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -44,10 +44,6 @@ modules = { VolatoolsModule('pslist', 'Print list of running processes', get_pslist), - 'dlllist': - VolatoolsModule('dlllist', - 'Print list of loaded dlls for each process', - get_dlllist), 'strings': VolatoolsModule('strings', 'Match physical offsets to virtual addresses (may take a while, VERY verbose)', -- 1.6.5.rc1

15 years, 9 months

4
5
0 0

[Patch] NewObject branch conversion of files module to plugin

by Mike Auty

Hi everybody, Another one, hot off the press. This time I went for the files module. I thought this one was going to be really tricky, but luckily most of the work had already been done in the xp_sp2.py for _EPROCESS objects. I spotted that the Array didn't seem to be generated properly, and I changed the function to return all objects (since I figured whatever was using them could narrow down the objects based on their type, rather than only ever returning file objects). Otherwise, it was just the plugin file that needed changing... 5:) I've also tried to ensure I don't do repeated checks and/or "is None" checks... 5;P Mike 5:) diff --git a/Volatility/memory_objects/Windows/xp_sp2.py b/Volatility/memory_objects/Windows/xp_sp2.py index 4cc4956..215a181 100644 --- a/Volatility/memory_objects/Windows/xp_sp2.py +++ b/Volatility/memory_objects/Windows/xp_sp2.py @@ -25,11 +25,11 @@ #pylint: disable-msg=C0111 -from forensics.object2 import CType, NewObject, NoneObject, NativeType, Curry -from forensics.win32.datetime import windows_to_unix_time +import forensics.object2 as object2 +import forensics.win32 as win32 import vmodules -class _UNICODE_STRING(CType): +class _UNICODE_STRING(object2.CType): """Class representing a _UNICODE_STRING Adds the following behavior: @@ -50,7 +50,7 @@ class _UNICODE_STRING(CType): def __str__(self): return self.v() -class _LIST_ENTRY(CType): +class _LIST_ENTRY(object2.CType): """ Adds iterators for _LIST_ENTRY types """ def list_of_type(self, type, member, forward=True): if not self.is_valid(): @@ -69,10 +69,10 @@ class _LIST_ENTRY(CType): while 1: ## Instantiate the object - obj = NewObject(type, offset = lst.offset - offset, - vm=self.vm, - parent=self.parent, - profile=self.profile, name=type) + obj = object2.NewObject(type, offset = lst.offset - offset, + vm=self.vm, + parent=self.parent, + profile=self.profile, name=type) if forward: @@ -89,7 +89,7 @@ class _LIST_ENTRY(CType): def __iter__(self): return self.list_of_type(self.parent.name, self.name) -class String(NativeType): +class String(object2.NativeType): def __init__(self, type, offset, vm=None, length=1, parent=None, profile=None, name=None, **args): ## Allow length to be a callable: @@ -99,7 +99,7 @@ class String(NativeType): pass ## length must be an integer - NativeType.__init__(self, type, offset, vm, parent=parent, profile=profile, + object2.NativeType.__init__(self, type, offset, vm, parent=parent, profile=profile, name=name, format_string="%ds" % length) def upper(self): @@ -113,7 +113,7 @@ class String(NativeType): ## Make sure its null terminated: return data.split("\x00")[0] -class WinTimeStamp(NativeType): +class WinTimeStamp(object2.NativeType): def __init__(self, type=None, offset=None, vm=None, value=None, parent=None, profile=None, name=None, **args): ## This allows us to have a WinTimeStamp object with a @@ -122,17 +122,17 @@ class WinTimeStamp(NativeType): if value: self.data = value else: - NativeType.__init__(self, type, offset, vm, parent=parent, profile=profile, - name=name, format_string="q") + object2.NativeType.__init__(self, type, offset, vm, parent=parent, profile=profile, + name=name, format_string="q") def value(self): """Override the value return, depending on whether we have a data field""" if self.data is not None: return self.data - return NativeType.value(self) + return object2.NativeType.value(self) def v(self): - return windows_to_unix_time(self.value()) + return win32.datetime.windows_to_unix_time(self.value()) def __sub__(self, x): return WinTimeStamp(value = self.value() - x.value()) @@ -143,7 +143,7 @@ class WinTimeStamp(NativeType): LEVEL_MASK = 0xfffffff8 -class _EPROCESS(CType): +class _EPROCESS(object2.CType): """ An extensive _EPROCESS with bells and whistles """ def _Peb(self, _attr): """ Returns a _PEB object which is using the process address space. @@ -155,13 +155,13 @@ class _EPROCESS(CType): process_ad = self.get_process_address_space() if process_ad: offset = self.m("Peb").v() - peb = NewObject("_PEB", offset, vm=process_ad, profile=self.profile, - name = "Peb", parent=self) + peb = object2.NewObject("_PEB", offset, vm=process_ad, profile=self.profile, + name = "Peb", parent=self) if peb.is_valid(): return peb - return NoneObject("Peb not found") + return object2.NoneObject("Peb not found") def get_process_address_space(self): """ Gets a process address space for a task given in _EPROCESS """ @@ -177,9 +177,8 @@ class _EPROCESS(CType): and iterates over them. """ - table = NewObject("Array", offset, self.vm, - count=0x200, parent=self, profile=self.profile, - target = Curry(NewObject, "_HANDLE_TABLE_ENTRY")) + table = object2.Array("_HANDLE_TABLE_ENTRY", offset=offset, vm=self.vm, + count=0x200, parent=self, profile=self.profile) for t in table: offset = t.dereference_as('unsigned int') if not offset.is_valid(): @@ -193,13 +192,11 @@ class _EPROCESS(CType): ## OK We got to the bottom table, we just resolve ## objects here: offset = int(offset) & ~0x00000007 - obj = NewObject("_OBJECT_HEADER", offset, self.vm, - parent=self, profile=self.profile) + obj = object2.NewObject("_OBJECT_HEADER", offset, self.vm, + parent=self, profile=self.profile) try: - if obj.Type.Name.__str__()=='File': - filevar = NewObject("_FILE_OBJECT", obj.Body.offset, self.vm, - parent=self, profile=self.profile) - yield filevar + if obj.Type.Name: + yield obj except Exception, _e: pass @@ -227,7 +224,7 @@ class _EPROCESS(CType): import socket, struct -class _TCPT_OBJECT(CType): +class _TCPT_OBJECT(object2.CType): def _RemoteIpAddress(self, attr): return socket.inet_ntoa(struct.pack("<I", self.m(attr).v())) diff --git a/Volatility/memory_plugins/internal/files.py b/Volatility/memory_plugins/internal/files.py new file mode 100644 index 0000000..7bce080 --- /dev/null +++ b/Volatility/memory_plugins/internal/files.py @@ -0,0 +1,78 @@ +''' +Created on 26 Sep 2009 + +@author: Mike Auty +''' + +#pylint: disable-msg=C0111 + +import forensics.commands +import forensics.win32 as win32 +import forensics.object2 as object2 +import forensics.utils as utils + +class files(forensics.commands.command): + """Print list of open files for each process""" + + def __init__(self, args=None): + forensics.commands.command.__init__(self, args) + self.profile = None + + def parser(self): + """Sets up the parser before execution""" + forensics.commands.command.parser(self) + + self.op.add_option('-o', '--offset', + help='EPROCESS Offset (in hex) in physical address space', + action='store', type='string', dest='offset') + + self.op.add_option('-p', '--pid', + help='Get info for this Pid', default=None, + action='store', type='int', dest='pid') + + def render_text(self, outfd, data): + first = True + for pid in data: + if not first: + outfd.write("*" * 72 + "\n") + outfd.write("Pid: %-6d\n" % pid) + first = False + + handles = data[pid] + for h in handles: + if h.FileName: + outfd.write("%-6s %-40s\n" % ("File", h.FileName)) + + def calculate(self): + result = {} + self.profile = object2.Profile() + + addr_space = utils.load_as(self.opts) + + if self.opts.offset: + try: + offset = int(self.opts.offset, 16) + except ValueError: + self.op.error("EPROCESS offset must be a hexadecimal number.") + + tasks = [object2.NewObject("_EPROCESS", offset, addr_space, profile=self.profile)] + + else: + tasks = win32.tasks.pslist(addr_space, self.profile) + + for task in tasks: + if task.ObjectTable.HandleTableList: + pid = int(task.ObjectTable.UniqueProcessId) + if self.opts.pid and pid != self.opts.pid: + continue + handles = task.handles() + + # Weed out just the file handles: + for h in handles: + if str(h.Type.Name) == 'File': + filevar = object2.NewObject("_FILE_OBJECT", h.Body.offset, task.vm, parent=task, profile=task.profile) + hlist = result.get(pid, []) + hlist.append(filevar) + result[pid] = hlist + + return result \ No newline at end of file diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index a910b03..2082b73 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -40,7 +40,7 @@ from forensics.object import read_unicode_string, read_obj from forensics.win32.tasks import module_base, module_path, module_size, create_addr_space, process_addr_space, process_command_line, process_dtb, process_find_pid from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot -from forensics.win32.handles import handle_entries, handle_process_id, handle_tables, handle_entry_object, is_object_file, object_data, file_name +from forensics.win32.handles import handle_entries, handle_process_id, handle_tables from forensics.win32.vad import vad_dump, vad_info, print_vad_dot_infix, print_vad_dot_prefix, print_vad_table, print_vad_tree, traverse_vad from forensics.win32.scan import module_scan, conn_scan, ps_scan_dot, ps_scan, socket_scan, thrd_scan from forensics.win32.crashdump import crash_to_dd, dd_to_crash @@ -295,87 +295,6 @@ def get_dlllist(cmdname, argv): print ################################### -# files - List open files -################################### -def print_entry_file(addr_space, types, entry): - - if not addr_space.is_valid_address(entry): - return - - obj = handle_entry_object(addr_space, types, entry) - if obj is None: - return - - if addr_space.is_valid_address(obj): - if is_object_file(addr_space, types, obj): - f = object_data(addr_space, types, obj) - fname = file_name(addr_space, types, f) - if fname != "": - print "%-6s %-40s" % ("File", fname) - -def get_open_files(cmdname, argv): - """ - Function prints a list of open files for each process. - """ - htables = [] - - op = get_standard_parser(cmdname) - - op.add_option('-o', '--offset', - help='EPROCESS Offset (in hex) in physical address space', - action='store', type='string', dest='offset') - - op.add_option('-p', '--pid', - help='Get info for this Pid', - action='store', type='int', dest='pid') - - opts, _args = op.parse_args(argv) - - filename = opts.filename - pid = opts.pid - - (addr_space, symtab, types) = load_and_identify_image(op, opts) - - if not opts.offset is None: - - try: - offset = int(opts.offset, 16) - except: - op.error("EPROCESS offset must be a hexadecimal number.") - - try: - flat_address_space = FileAddressSpace(filename) - except: - op.error("Unable to open image file %s" % (filename)) - - ObjectTable = process_handle_table(flat_address_space, types, offset) - - if addr_space.is_valid_address(ObjectTable): - htables.append(ObjectTable) - - else: - - htables = handle_tables(addr_space, types, symtab, pid) - - - star_line = '*' * 72 - - for table in htables: - if len(htables) > 1: - print "%s" % star_line - - process_id = handle_process_id(addr_space, types, table) - if process_id == None: - continue - - print "Pid: %-6d" % (process_id) - - entries = handle_entries(addr_space, types, table) - for hentry in entries: - print_entry_file(addr_space, types, hentry) - - -################################### # strings - identify pid(s) associated with a string ################################### def print_string(offset, pidlist, string): diff --git a/Volatility/volatility.py b/Volatility/volatility.py index a765579..baee253 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -48,10 +48,6 @@ modules = { VolatoolsModule('dlllist', 'Print list of loaded dlls for each process', get_dlllist), - 'files': - VolatoolsModule('files', - 'Print list of open files for each process', - get_open_files), 'strings': VolatoolsModule('strings', 'Match physical offsets to virtual addresses (may take a while, VERY verbose)',

15 years, 9 months

1
0
0 0

[Patch] NewObject branch conversion of internal connections module to plugin

by Mike Auty

Hiya guys, A slightly bigger and more complex one this time round. This is the next module I've attempted to convert into a plugin. It seems a bit fiddly, because you've got to jump around in memory looking for the right spot (depending on the sys file that created it), so the error checking on it could probably do with some improvements, but hopefully the object model will automatically detect and mark as None any invalid addresses we might ask for. Again, any comments or criticisms would be gratefully received, I'm not sure if I'm allowed to just invent type names like I've done for the table pointers, and I'd also like to know whether the result of a calculation can contain types, or whether I should be putting the data into dicts/lists? I'm also wondering what could be done about the plugin namespace, because at the moment, there's no way of extending another plugin from a different module (because relative addressing only works within a python module, and we haven't been adding __init__.py files to the memory_plugins directory). Is there a good way of inheriting from a plugin, or should we just be putting the main functionality under forensics.win32 and then make the plugins as empty as possible? The *scan/scan2 functions look like they'll be trickier to convert, if anyone with a good understanding of the NewObject model would like to have a go at converting one of them, it'd help me a lot as a template to get the others converted. If not, I'll have to wing it... 5;P Mike 5:) diff --git a/Volatility/forensics/object2.py b/Volatility/forensics/object2.py index 29552d8..f4f9181 100644 --- a/Volatility/forensics/object2.py +++ b/Volatility/forensics/object2.py @@ -99,6 +99,9 @@ class NoneObject(object): def __iter__(self): return self + def __len__(self): + return 0 + def next(self): raise StopIteration() @@ -588,8 +591,14 @@ class Profile: system. We parse the abstract_types and join them with native_types to make everything work together. """ - def __init__(self, native_types=x86_native_types, abstract_types=types, - overlay=xpsp2overlays, strict=False): + def __init__(self, native_types=None, abstract_types=None, + overlay=None, strict=False): + if native_types is None: + native_types = x86_native_types + if abstract_types is None: + abstract_types = types + if overlay is None: + overlay = xpsp2overlays self.types = {} self.strict = strict diff --git a/Volatility/forensics/win32/network.py b/Volatility/forensics/win32/network.py index 5ee84d6..b4598dd 100644 --- a/Volatility/forensics/win32/network.py +++ b/Volatility/forensics/win32/network.py @@ -29,6 +29,8 @@ #pylint: disable-msg=C0111 import struct +import forensics.win32 as win32 +import forensics.object2 as object2 from forensics.object import read_value, read_obj, get_obj_offset from forensics.win32.datetime import read_time, windows_to_unix_time from forensics.win32.modules import module_find_baseaddr, modules_list @@ -60,10 +62,10 @@ module_versions = { \ 'AddrObjTableSizeOffset' : [0x48664], \ }, '3394': { - 'TCBTableOff': [0x49768], \ - 'SizeOff': [0x3F73C], \ - 'AddrObjTableOffset': [0x486E0], \ - 'AddrObjTableSizeOffset': [0x486E4], \ + 'TCBTableOff': [0x49768], \ + 'SizeOff': [0x3F73C], \ + 'AddrObjTableOffset': [0x486E0], \ + 'AddrObjTableSizeOffset': [0x486E4], \ }, '5625' : { \ 'TCBTableOff' : [0x49ae8], \ @@ -80,6 +82,35 @@ module_versions = { \ } +def determine_connections(addr_space, profile): + """Determines all connections for each module""" + all_modules = win32.modules.lsmod(addr_space, profile) + + profile.add_types({'_TCPT_OBJECT_POINTER': [0x4, + {'Pointer': [0x0, ['pointer', ['_TCPT_OBJECT']]]} + ]}) + + connections = [] + + for m in all_modules: + if str(m.ModuleName).lower() == 'tcpip.sys': + for attempt in module_versions: + table_size = object2.NewObject("unsigned long", m.BaseAddress + module_versions[attempt]['SizeOff'][0], addr_space, profile=profile) + table_addr = object2.NewObject("unsigned long", m.BaseAddress + module_versions[attempt]['TCBTableOff'][0], addr_space, profile=profile) + if int(table_size) > 0: + table = object2.Array('Array', table_addr, addr_space, count=table_size, profile=profile, + target=object2.Curry(object2.NewObject, '_TCPT_OBJECT_POINTER')) + for entry in table: + if entry is None: + break + conn = entry.Pointer.dereference() + while conn.is_valid(): + connections.append(conn) + conn = conn.Next + return connections + + return object2.NoneObject("Unable to determine connections") + def tcb_connections(addr_space, types, symbol_table): all_modules = modules_list(addr_space, types, symbol_table) base_addr = module_find_baseaddr(addr_space, types, all_modules,"tcpip") diff --git a/Volatility/memory_plugins/internal/connections.py b/Volatility/memory_plugins/internal/connections.py new file mode 100644 index 0000000..91a1fff --- /dev/null +++ b/Volatility/memory_plugins/internal/connections.py @@ -0,0 +1,40 @@ +''' +Created on 25 Sep 2009 + +@author: Mike Auty +''' + +#pylint: disable-msg=C0111 + +import forensics.commands +import forensics.win32 as win32 +import forensics.object2 as object2 +import forensics.utils as utils + +class connections(forensics.commands.command): + """Print list of open connections""" + + def __init__(self, args=None): + forensics.commands.command.__init__(self, args) + self.profile = None + + def render_text(self, outfd, data): + if len(data): + outfd.write("%-25s %-25s %-6s\n" % ('Local Address', 'Remote Address', 'Pid')) + + for conn in data: + local = "%s:%s" % (conn.LocalIpAddress, conn.LocalPort) + remote = "%s:%s" % (conn.RemoteIpAddress, conn.RemotePort) + outfd.write("%-25s %-25s %-6d\n" % (local, remote, conn.Pid)) + + + def calculate(self): + result = {} + self.profile = object2.Profile() + + addr_space = utils.load_as(self.opts) + + # Get the Image Datetime + result = win32.network.determine_connections(addr_space, self.profile) + + return result \ No newline at end of file diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index ec642f8..46bef38 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -41,7 +41,6 @@ from forensics.win32.tasks import module_base, module_path, module_size, create_ from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot from forensics.win32.modules import modules_list -from forensics.win32.network import connection_laddr, connection_lport, connection_raddr, connection_rport, connection_pid, tcb_connections from forensics.win32.network import socket_create_time, socket_local_port, socket_pid, socket_protocol, open_sockets from forensics.win32.handles import handle_entries, handle_process_id, handle_tables, handle_entry_object, is_object_file, object_data, file_name from forensics.win32.modules import module_baseaddr, module_imagename, module_imagesize, module_modulename @@ -336,39 +335,6 @@ def get_dlllist(cmdname, argv): print ################################### -# connections - List open connections -################################### -def get_connections(cmdname, argv): - """ - Function prints a list of open connections - """ - op = get_standard_parser(cmdname) - opts, _args = op.parse_args(argv) - - (addr_space, symtab, types) = load_and_identify_image(op, opts) - - connections = tcb_connections(addr_space, types, symtab) - - if len(connections) > 0: - print "%-25s %-25s %-6s" % ('Local Address', 'Remote Address', 'Pid') - - for connection in connections: - - if not addr_space.is_valid_address(connection): - continue - - pid = connection_pid(addr_space, types, connection) - lport = connection_lport(addr_space, types, connection) - laddr = connection_laddr(addr_space, types, connection) - rport = connection_rport(addr_space, types, connection) - raddr = connection_raddr(addr_space, types, connection) - - local = "%s:%d" % (laddr, lport) - remote = "%s:%d" % (raddr, rport) - - print "%-25s %-25s %-6d" % (local, remote, pid) - -################################### # sockets - List open sockets ################################### def get_sockets(cmdname, argv): diff --git a/Volatility/volatility.py b/Volatility/volatility.py index 4e04aeb..ebdf02e 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -56,10 +56,6 @@ modules = { VolatoolsModule('files', 'Print list of open files for each process', get_open_files), - 'connections': - VolatoolsModule('connections', - 'Print list of open connections', - get_connections), 'modules': VolatoolsModule('modules', 'Print list of loaded modules',

15 years, 9 months

2
1
0 0

[Patch] NewObject branch conversion of modules and sockets to plugins

by Mike Auty

Hi again, Michael, thanks for adding in my patches (and fixing up my antiquated python!)... 5:) I'm still working towards moving all the modules over to plugins, and so here's a couple more. I've been cleaning up the various forensics.win32 files as I go once a function's no longer called. It will break compatibility with old plugins, but I think we've already covered this and decided that cleaning things up is the best way to let new people get into it, and old devs figure out what they should use and what they shouldn't. As ever, do let me know if there's any stylistic changes, or functionality issues, and please feel free to improve them in any way! 5;) Mike 5:) >From e31e38da3b559715f735afd5f112092e6d0ad60e Mon Sep 17 00:00:00 2001 From: Mike Auty <mike.auty(a)gmail.com> Date: Sat, 26 Sep 2009 12:49:47 +0100 Subject: [PATCH] Add in modules plugin. --- Volatility/forensics/win32/network.py | 73 ------------------------- Volatility/memory_plugins/internal/modules.py | 39 +++++++++++++ Volatility/vmodules.py | 39 ------------- Volatility/volatility.py | 4 -- 4 files changed, 39 insertions(+), 116 deletions(-) create mode 100644 Volatility/memory_plugins/internal/modules.py diff --git a/Volatility/forensics/win32/network.py b/Volatility/forensics/win32/network.py index b4598dd..7ebad10 100644 --- a/Volatility/forensics/win32/network.py +++ b/Volatility/forensics/win32/network.py @@ -111,79 +111,6 @@ def determine_connections(addr_space, profile): return object2.NoneObject("Unable to determine connections") -def tcb_connections(addr_space, types, symbol_table): - all_modules = modules_list(addr_space, types, symbol_table) - base_addr = module_find_baseaddr(addr_space, types, all_modules,"tcpip") - - if base_addr is None: - return [] - - connection_list = [] - - connection_list = find_connections(addr_space, types, symbol_table, base_addr) - - return connection_list - -def get_tcb_connections(addr_space, types, _symbol_table, base_addr, TCBTableOff, SizeOff): - - TCBTable = base_addr + TCBTableOff - MaxHashTableSize = base_addr + SizeOff - - - TCBTableAddr = read_value(addr_space, 'unsigned long', TCBTable) - - if TCBTableAddr == None: - return [] - - if not addr_space.is_valid_address(TCBTableAddr): - return [] - - TableSize = read_value(addr_space, 'unsigned long', MaxHashTableSize) - - if TableSize == None: - return [] - - connection_list = [] - for cnt in range(0, TableSize): - EntryAddress = TCBTableAddr + 4*cnt - - if not addr_space.is_valid_address(EntryAddress): - continue - - TableEntry = read_value(addr_space, 'unsigned long', EntryAddress) - if TableEntry == 0 or TableEntry == None: - continue - - next = read_obj(addr_space, types, - ['_TCPT_OBJECT', 'Next'], TableEntry) - - while next != 0x0: - if not addr_space.is_valid_address(next): - print "ConnectionList Truncated Invalid 0x%x" % next - return connection_list - connection_list.append(next) - next = read_obj(addr_space, types, - ['_TCPT_OBJECT', 'Next'], next) - - connection_list.append(TableEntry) - - return connection_list - - -def find_connections(addr_space, types, symbol_table, base_addr): - - connection_list = [] - - for offsets in module_versions: - offsets = module_versions[offsets] - - connection_list = get_tcb_connections(addr_space, types, symbol_table, base_addr, offsets['TCBTableOff'][0], offsets['SizeOff'][0]) - if len(connection_list) > 0: - return connection_list - - return connection_list - - def connection_pid(addr_space, types, connection_vaddr): return read_obj(addr_space, types, ['_TCPT_OBJECT', 'Pid'], connection_vaddr) diff --git a/Volatility/memory_plugins/internal/modules.py b/Volatility/memory_plugins/internal/modules.py new file mode 100644 index 0000000..7436b2a --- /dev/null +++ b/Volatility/memory_plugins/internal/modules.py @@ -0,0 +1,39 @@ +''' +Created on 25 Sep 2009 + +@author: Mike Auty +''' + +#pylint: disable-msg=C0111 + +import forensics.commands +import forensics.win32 as win32 +import forensics.object2 as object2 +import forensics.utils as utils + +class modules(forensics.commands.command): + """Print list of loaded modules""" + + def __init__(self, args=None): + forensics.commands.command.__init__(self, args) + self.profile = None + + def render_text(self, outfd, data): + header = False + + for module in data: + if not header: + outfd.write("%-50s %-12s %-8s %s\n" % ('File', 'Base', 'Size', 'Name')) + header = True + outfd.write("%-50s 0x%0.10x 0x%0.6x %s\n" % (module.FullDllName, int(module.BaseAddress.value()), int(module.SizeOfImage), module.ModuleName)) + + + def calculate(self): + result = {} + self.profile = object2.Profile() + + addr_space = utils.load_as(self.opts) + + result = win32.modules.lsmod(addr_space, self.profile) + + return result \ No newline at end of file diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index 46bef38..80748fd 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -40,10 +40,8 @@ from forensics.object import read_unicode_string, read_obj from forensics.win32.tasks import module_base, module_path, module_size, create_addr_space, process_addr_space, process_command_line, process_dtb, process_find_pid from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot -from forensics.win32.modules import modules_list from forensics.win32.network import socket_create_time, socket_local_port, socket_pid, socket_protocol, open_sockets from forensics.win32.handles import handle_entries, handle_process_id, handle_tables, handle_entry_object, is_object_file, object_data, file_name -from forensics.win32.modules import module_baseaddr, module_imagename, module_imagesize, module_modulename from forensics.win32.vad import vad_dump, vad_info, print_vad_dot_infix, print_vad_dot_prefix, print_vad_table, print_vad_tree, traverse_vad from forensics.win32.scan import module_scan, conn_scan, ps_scan_dot, ps_scan, socket_scan, thrd_scan from forensics.win32.crashdump import crash_to_dd, dd_to_crash @@ -75,43 +73,6 @@ def format_time(time): return ts ################################### -# modules list -################################### -def get_modules(cmdname, argv): - """ - Function prints a formatted table of module information - """ - op = get_standard_parser(cmdname) - opts, _args = op.parse_args(argv) - - (addr_space, symtab, types) = load_and_identify_image(op, opts) - - all_modules = modules_list(addr_space, types, symtab) - - print "%-50s %-12s %-8s %s" % ('File', 'Base', 'Size', 'Name') - - for module in all_modules: - if not addr_space.is_valid_address(module): - continue - module_image = module_imagename(addr_space, types, module) - if module_image is None: - module_image = "UNKNOWN" - - module_name = module_modulename(addr_space, types, module) - if module_name is None: - module_name = "UNKNOWN" - - module_base = module_baseaddr(addr_space, types, module) - if module_base is None: - module_base = "UNKNOWN" - else: - module_base = "0x%010x" % module_base - - module_size = module_imagesize(addr_space, types, module) - - print "%-50s %s 0x%06x %s" % (module_image, module_base, module_size, module_name) - -################################### # pslist - process list ################################### def get_pslist(cmdname, argv): diff --git a/Volatility/volatility.py b/Volatility/volatility.py index ebdf02e..dc7b894 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -56,10 +56,6 @@ modules = { VolatoolsModule('files', 'Print list of open files for each process', get_open_files), - 'modules': - VolatoolsModule('modules', - 'Print list of loaded modules', - get_modules), 'strings': VolatoolsModule('strings', 'Match physical offsets to virtual addresses (may take a while, VERY verbose)', -- 1.6.5.rc1 >From 8d39cba526fed7885bdfece50d981f1856487555 Mon Sep 17 00:00:00 2001 From: Mike Auty <mike.auty(a)gmail.com> Date: Sat, 26 Sep 2009 13:00:01 +0100 Subject: [PATCH] Add in sockets plugin. --- Volatility/forensics/win32/modules.py | 46 +----------- Volatility/forensics/win32/network.py | 96 ++++++++----------------- Volatility/memory_plugins/internal/sockets.py | 39 ++++++++++ Volatility/vmodules.py | 30 -------- Volatility/volatility.py | 4 - 5 files changed, 71 insertions(+), 144 deletions(-) create mode 100644 Volatility/memory_plugins/internal/sockets.py diff --git a/Volatility/forensics/win32/modules.py b/Volatility/forensics/win32/modules.py index 7b20ff1..9f438aa 100644 --- a/Volatility/forensics/win32/modules.py +++ b/Volatility/forensics/win32/modules.py @@ -25,8 +25,8 @@ #pylint: disable-msg=C0111 -from forensics.object import read_obj, read_unicode_string, get_obj_offset -from forensics.win32.info import find_psloadedmodulelist, kpcr_addr +from forensics.object import read_obj, read_unicode_string +from forensics.win32.info import kpcr_addr from forensics.object2 import NewObject def lsmod(addr_space, profile): @@ -55,48 +55,6 @@ def lsmod(addr_space, profile): "_LDR_MODULE", "InLoadOrderModuleList"): yield l -def modules_list(addr_space, types, _symbol_table): - """ - Get the virtual addresses of all Windows modules - """ - modules_list = [] - - PsLoadedModuleList = find_psloadedmodulelist(addr_space, types) - - if not PsLoadedModuleList is None: - (offset, _tmp) = get_obj_offset(types, \ - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks']) - - first_module = PsLoadedModuleList - offset - - current = read_obj(addr_space, types, \ - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks', 'Flink'], - first_module) - - this_module = current - offset - - next = read_obj(addr_space, types, \ - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks', 'Flink'], - this_module) - - while this_module != PsLoadedModuleList: - - if not addr_space.is_valid_address(this_module): - print "Module list truncated, unable to read 0x%x." % (this_module) - return modules_list - - modules_list.append(this_module) - current = read_obj(addr_space, types, \ - ['_LDR_DATA_TABLE_ENTRY', 'InLoadOrderLinks', 'Flink'], - this_module) - this_module = current - offset - - if not addr_space.is_valid_address(this_module): - print "ModuleList Truncated Invalid Module" - return modules_list - - return modules_list - def module_imagename(address_space, types, module_vaddr): return read_unicode_string(address_space, types, ['_LDR_DATA_TABLE_ENTRY', 'FullDllName'], module_vaddr) diff --git a/Volatility/forensics/win32/network.py b/Volatility/forensics/win32/network.py index 7ebad10..bb1f182 100644 --- a/Volatility/forensics/win32/network.py +++ b/Volatility/forensics/win32/network.py @@ -31,9 +31,8 @@ import struct import forensics.win32 as win32 import forensics.object2 as object2 -from forensics.object import read_value, read_obj, get_obj_offset +from forensics.object import read_obj, get_obj_offset from forensics.win32.datetime import read_time, windows_to_unix_time -from forensics.win32.modules import module_find_baseaddr, modules_list from socket import ntohs, inet_ntoa module_versions = { \ @@ -111,6 +110,35 @@ def determine_connections(addr_space, profile): return object2.NoneObject("Unable to determine connections") +def determine_sockets(addr_space, profile): + """Determines all sockets for each module""" + all_modules = win32.modules.lsmod(addr_space, profile) + + profile.add_types({'_ADDRESS_OBJECT_POINTER': [0x4, + {'Pointer': [0x0, ['pointer', ['_ADDRESS_OBJECT']]]} + ]}) + + sockets = [] + + for m in all_modules: + if str(m.ModuleName).lower() == 'tcpip.sys': + for attempt in module_versions: + table_size = object2.NewObject("unsigned long", m.BaseAddress + module_versions[attempt]['AddrObjTableSizeOffset'][0], addr_space, profile=profile) + table_addr = object2.NewObject("unsigned long", m.BaseAddress + module_versions[attempt]['AddrObjTableOffset'][0], addr_space, profile=profile) + if int(table_size) > 0: + table = object2.Array('Array', table_addr, addr_space, count=table_size, profile=profile, + target=object2.Curry(object2.NewObject, '_ADDRESS_OBJECT_POINTER')) + for entry in table: + if entry is None: + break + sock = entry.Pointer.dereference() + while sock.is_valid(): + sockets.append(sock) + sock = sock.Next + return sockets + + return object2.NoneObject("Unable to determine sockets") + def connection_pid(addr_space, types, connection_vaddr): return read_obj(addr_space, types, ['_TCPT_OBJECT', 'Pid'], connection_vaddr) @@ -133,70 +161,6 @@ def connection_raddr(addr_space, types, connection_vaddr): ['_TCPT_OBJECT', 'RemoteIpAddress'], connection_vaddr) return inet_ntoa(struct.pack('=L', raddr)) -def open_sockets(addr_space, types, symbol_table): - all_modules = modules_list(addr_space, types, symbol_table) - base_addr = module_find_baseaddr(addr_space, types, all_modules,"tcpip") - - if base_addr is None: - return [] - - socket_list = [] - - socket_list = find_sockets(addr_space, types, symbol_table, base_addr) - - return socket_list - -def get_open_sockets(addr_space, types, _symbol_table, base_addr, AddrObjTableOffset, AddrObjTableSizeOffset): - - AddrObjTable = base_addr + AddrObjTableOffset - AddrObjTableSize = base_addr + AddrObjTableSizeOffset - - AddrObjAddr = read_value(addr_space, 'unsigned long', AddrObjTable) - AddrTableSize = read_value(addr_space, 'unsigned long', AddrObjTableSize) - - if AddrObjAddr == None or AddrTableSize == None: - return [] - - socket_list = [] - for cnt in range(0, AddrTableSize): - EntryAddress = AddrObjAddr + 4*cnt - - if not addr_space.is_valid_address(EntryAddress): - continue - - TableEntry = read_value(addr_space, 'unsigned long', EntryAddress) - if TableEntry == 0 or TableEntry == None: - continue - - socket_list.append(TableEntry) - next = read_obj(addr_space, types, - ['_ADDRESS_OBJECT', 'Next'], TableEntry) - - while next != 0x0: - if not addr_space.is_valid_address(next): - print "SocketList Truncated Invalid 0x%x" % next - return socket_list - socket_list.append(next) - next = read_obj(addr_space, types, - ['_ADDRESS_OBJECT', 'Next'], next) - - return socket_list - - -def find_sockets(addr_space, types, symbol_table, base_addr): - - socket_list = [] - - for offsets in module_versions: - offsets = module_versions[offsets] - - socket_list = get_open_sockets(addr_space, types, symbol_table, base_addr, offsets['AddrObjTableOffset'][0], offsets['AddrObjTableSizeOffset'][0]) - if len(socket_list) > 0: - return socket_list - - return socket_list - - def socket_pid(addr_space, types, socket_vaddr): return read_obj(addr_space, types, ['_ADDRESS_OBJECT', 'Pid'], socket_vaddr) diff --git a/Volatility/memory_plugins/internal/sockets.py b/Volatility/memory_plugins/internal/sockets.py new file mode 100644 index 0000000..b931964 --- /dev/null +++ b/Volatility/memory_plugins/internal/sockets.py @@ -0,0 +1,39 @@ +''' +Created on 25 Sep 2009 + +@author: Mike Auty +''' + +#pylint: disable-msg=C0111 + +import forensics.commands +import forensics.win32 as win32 +import forensics.object2 as object2 +import forensics.utils as utils +import socket + +class sockets(forensics.commands.command): + """Print list of open sockets""" + + def __init__(self, args=None): + forensics.commands.command.__init__(self, args) + self.profile = None + + def render_text(self, outfd, data): + if len(data): + outfd.write("%-6s %-6s %-6s %-26s\n" % ('Pid', 'Port', 'Proto', 'Create Time')) + + for sock in data: + outfd.write("%-6s %-6s %-6s %-26s\n" % (int(sock.Pid), socket.ntohs(sock.LocalPort), int(sock.Protocol), sock.CreateTime)) + + + def calculate(self): + result = {} + self.profile = object2.Profile() + + addr_space = utils.load_as(self.opts) + + # Get the Image Datetime + result = win32.network.determine_sockets(addr_space, self.profile) + + return result \ No newline at end of file diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index 80748fd..8633c7a 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -40,7 +40,6 @@ from forensics.object import read_unicode_string, read_obj from forensics.win32.tasks import module_base, module_path, module_size, create_addr_space, process_addr_space, process_command_line, process_dtb, process_find_pid from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot -from forensics.win32.network import socket_create_time, socket_local_port, socket_pid, socket_protocol, open_sockets from forensics.win32.handles import handle_entries, handle_process_id, handle_tables, handle_entry_object, is_object_file, object_data, file_name from forensics.win32.vad import vad_dump, vad_info, print_vad_dot_infix, print_vad_dot_prefix, print_vad_table, print_vad_tree, traverse_vad from forensics.win32.scan import module_scan, conn_scan, ps_scan_dot, ps_scan, socket_scan, thrd_scan @@ -296,35 +295,6 @@ def get_dlllist(cmdname, argv): print ################################### -# sockets - List open sockets -################################### -def get_sockets(cmdname, argv): - """ - Function prints a list of open sockets. - """ - op = get_standard_parser(cmdname) - opts, _args = op.parse_args(argv) - - (addr_space, symtab, types) = load_and_identify_image(op, opts) - - sockets = open_sockets(addr_space, types, symtab) - - if len(sockets) > 0: - print "%-6s %-6s %-6s %-26s" % ('Pid', 'Port', 'Proto', 'Create Time') - - for socket in sockets: - - if not addr_space.is_valid_address(socket): - continue - - pid = socket_pid(addr_space, types, socket) - proto = socket_protocol(addr_space, types, socket) - port = socket_local_port(addr_space, types, socket) - time = socket_create_time(addr_space, types, socket) - - print "%-6d %-6d %-6d %-26s" % (pid, port, proto, format_time(time)) - -################################### # files - List open files ################################### def print_entry_file(addr_space, types, entry): diff --git a/Volatility/volatility.py b/Volatility/volatility.py index dc7b894..65f6732 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -48,10 +48,6 @@ modules = { VolatoolsModule('dlllist', 'Print list of loaded dlls for each process', get_dlllist), - 'sockets': - VolatoolsModule('sockets', - 'Print list of open sockets', - get_sockets), 'files': VolatoolsModule('files', 'Print list of open files for each process', -- 1.6.5.rc1

15 years, 9 months

1
0
0 0

[Patch] NewObject load_as error checking improvements

by Mike Auty

Hiya guys, Here's the first of a few patches. This one should improve the error checking during the utils.load_as function call. Now if the base address space can't be instantiated, it raises it's own form of exception allowing the main program to catch it and report back gracefully what went wrong. Without this, just running volatility followed by a plugin name would fail as the filename address space assumed a filename option would always be present... Mike 5:) diff --git a/Volatility/forensics/utils.py b/Volatility/forensics/utils.py index 69eccd2..0ff3151 100644 --- a/Volatility/forensics/utils.py +++ b/Volatility/forensics/utils.py @@ -19,7 +19,12 @@ def load_as(opts): ## selecting us means we are done: if not found: break + + if base_as is None: + raise AddrSpaceError("No suitable address space maaping found") return base_as - +class AddrSpaceError(Exception): + """Address Space Exception, so we can catch and deal with it in the main program""" + pass \ No newline at end of file diff --git a/Volatility/memory_objects/Windows/xp_sp2.py b/Volatility/memory_objects/Windows/xp_sp2.py index 7cd97e0..2a8887e 100644 --- a/Volatility/memory_objects/Windows/xp_sp2.py +++ b/Volatility/memory_objects/Windows/xp_sp2.py @@ -25,7 +25,7 @@ #pylint: disable-msg=C0111 -from forensics.object2 import CType, NewObject, NativeType, Curry +from forensics.object2 import CType, NewObject, NoneObject, NativeType, Curry from vtypes import xpsp2types as types from forensics.win32.datetime import windows_to_unix_time import vmodules diff --git a/Volatility/memory_plugins/address_spaces/standard.py b/Volatility/memory_plugins/address_spaces/standard.py index 2712e09..1d4844e 100644 --- a/Volatility/memory_plugins/address_spaces/standard.py +++ b/Volatility/memory_plugins/address_spaces/standard.py @@ -23,6 +23,7 @@ class FileAddressSpace(addrspace.BaseAddressSpace): def __init__(self, base, opts): addrspace.BaseAddressSpace.__init__(self, base, opts) assert(base == None) + assert(opts['filename'] is not None) self.name = opts['filename'] self.fname = self.name self.mode = opts.get('mode','rb') diff --git a/Volatility/vmodules.py b/Volatility/vmodules.py index 46737d1..ec642f8 100644 --- a/Volatility/vmodules.py +++ b/Volatility/vmodules.py @@ -37,7 +37,6 @@ from forensics.addrspace import FileAddressSpace from forensics.win32.hiber_addrspace import WindowsHiberFileSpace32 from forensics.win32.crash_addrspace import WindowsCrashDumpSpace32 from forensics.object import read_unicode_string, read_obj -from forensics.win32.datetime import local_time, windows_to_unix_time from forensics.win32.tasks import module_base, module_path, module_size, create_addr_space, process_addr_space, process_command_line, process_dtb, process_find_pid from forensics.win32.tasks import process_imagename, process_ldrs, process_list, process_peb, process_pid, process_handle_table, process_create_time, process_handle_count from forensics.win32.tasks import process_inherited_from, process_num_active_threads, process_vadroot diff --git a/Volatility/volatility.py b/Volatility/volatility.py index a377749..4e04aeb 100644 --- a/Volatility/volatility.py +++ b/Volatility/volatility.py @@ -35,6 +35,7 @@ import sys import os import forensics.registry as MemoryRegistry +import forensics.utils from vmodules import * @@ -201,12 +202,15 @@ def main(argv=sys.argv): print "Error: Invalid module [%s]." % (argv[1]) usage(argv[0]) - if modules.has_key(argv[1]): - modules[argv[1]].execute(argv[1], argv[2:]) - elif MemoryRegistry.PLUGIN_COMMANDS.commands.has_key(argv[1]): - command = MemoryRegistry.PLUGIN_COMMANDS[argv[1]](argv[2:]) - command.execute() - + try: + if modules.has_key(argv[1]): + modules[argv[1]].execute(argv[1], argv[2:]) + elif MemoryRegistry.PLUGIN_COMMANDS.commands.has_key(argv[1]): + command = MemoryRegistry.PLUGIN_COMMANDS[argv[1]](argv[2:]) + command.execute() + except forensics.utils.AddrSpaceError: + print "Error: No suitable address space found, please check your options." + usage(argv[0]) if __name__ == "__main__": main()

15 years, 9 months

2
1
0 0

[Patch] NewObject branch wintimestamp subtraction improvement

by Mike Auty

Hi again, This one's a very quick one, it just ensures that subtraction happens on the raw value of the data (by overriding type.value rather than just type.v). This allows two wintimestamps to be subtracted, without passing them through windows_to_unix_time first (which maps a number of small windows times down to 0). I'm not certain of the difference between type.v and type.value, so if there's some reason we shouldn't be overriding this, do please let me know... 5;) Without this, subtracting a TimeZoneBias (in the form of a wintimestamp) from another wintimestamp will probably leave the original wintimestamp the same (since the TimeZoneBias will register as unixtime 0)... Mike 5:) diff --git a/Volatility/memory_objects/Windows/xp_sp2.py b/Volatility/memory_objects/Windows/xp_sp2.py index 2a8887e..4cc4956 100644 --- a/Volatility/memory_objects/Windows/xp_sp2.py +++ b/Volatility/memory_objects/Windows/xp_sp2.py @@ -26,7 +26,6 @@ #pylint: disable-msg=C0111 from forensics.object2 import CType, NewObject, NoneObject, NativeType, Curry -from vtypes import xpsp2types as types from forensics.win32.datetime import windows_to_unix_time import vmodules @@ -42,10 +41,10 @@ class _UNICODE_STRING(CType): try: length = self.Length.v() if length > 1024: - length=0 + length = 0 data = self.vm.read(self.Buffer.v(), length) return data.decode("utf16","ignore").encode("ascii",'backslashreplace') - except Exception, e: + except Exception, _e: return '' def __str__(self): @@ -119,20 +118,24 @@ class WinTimeStamp(NativeType): parent=None, profile=None, name=None, **args): ## This allows us to have a WinTimeStamp object with a ## predetermined value + self.data = None if value: self.data = value else: NativeType.__init__(self, type, offset, vm, parent=parent, profile=profile, name=name, format_string="q") - def v(self): - try: + def value(self): + """Override the value return, depending on whether we have a data field""" + if self.data is not None: return self.data - except: - return windows_to_unix_time(NativeType.v(self)) + return NativeType.value(self) + + def v(self): + return windows_to_unix_time(self.value()) def __sub__(self, x): - return WinTimeStamp(value = self.v() - x.v()) + return WinTimeStamp(value = self.value() - x.value()) def __str__(self): return vmodules.format_time(self.v()) @@ -142,7 +145,7 @@ LEVEL_MASK = 0xfffffff8 class _EPROCESS(CType): """ An extensive _EPROCESS with bells and whistles """ - def _Peb(self,attr): + def _Peb(self, _attr): """ Returns a _PEB object which is using the process address space. The PEB structure is referencing back into the process address @@ -198,7 +201,7 @@ class _EPROCESS(CType): parent=self, profile=self.profile) yield filevar - except Exception, e: + except Exception, _e: pass def handles(self):

15 years, 9 months

1
0
0 0

Re: [Vol-dev] [patch] Pylint improvements for new_object

by Michael Cohen

Hi Mike, Thanks for the patch. I tried to update it in the spirit of the new object framework. Im sure you already know what im about to say but this is to clarify for other members of the list. When you add a vtype overlay like + '_KUSER_SHARED_DATA' : [ None, { \ + 'SystemTime' : [ None, ['WinTimeStamp', {}]], \ + 'TimeZoneBias' : [ None, ['WinTimeStamp', {}]], \ + }], You are saying that a WinTimeStamp object should be used to decode these fields. This overrides the standard definition in vtypes.py: '_KUSER_SHARED_DATA' : [ 0x338, { \ 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], \ 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], \ 'SuiteMask' : [ 0x2d0, ['unsigned long']], \ 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], \ so in your ident module when you do this: k = object2.NewObject("_KUSER_SHARED_DATA", win32.info.KUSER_SHARED_DATA, addr_space, profile=self.profile) you will actually get an instance of WinTimeStamp back. Since adding and subtracting time is quite common its worth adding a __sub__ method to this class so you can just do: return k.SystemTime - k.TimeZoneBias Which is more readable and easier to understand - also note that this should return a WinTimeStamp object - typically with the new command reorg we try to ensure that we dont pass strings until the very end - so as not to lose information. Note that expanding a WinTimeStamp into a string will format it. You should try to use construct like outfd.write(" Datetime: %s\n" % data['ImageDatetime']) instead of outfd.write(" Datetime: " + data['ImageDatetime']) The latter breaks when data is not a string (which it should not usually be) Finally try to return NoneObject( reason) from functions rather than None - this allows you to do stuff like: for task in win32.tasks.pslist(addr_space, self.profile): if task.Peb.CSDVersion: instead of + for task in win32.tasks.pslist(addr_space, self.profile): + if task.Peb is not None: + if task.Peb.CSDVersion is not None: Which is more error prone because you can forget to check for None at a certain level for a timebomb bug. Admittadly I fixed a bug where pslist() didnt do this it was my fault - but thats what we aim for. Note that NoneObjects can be deferenced as much as you like to produce the same NoneObject (i.e. the original fault is propagated). This is important since in memory forensics sometime you will fail to dereference a point which you thought was there (e.g. if its paged out) so at least this allows the code to proceed without raising and prevents you from having to check every single dereference for success. Hope this help, Michael. On Mon, Sep 21, 2009 at 8:34 AM, Mike Auty <mike.auty(a)gmail.com> wrote: > Michael Cohen wrote: >> Hi Mike, > > Hiya Michael! > >> Ok I will push it to the repository. I must admit im not a fan of svn >> so im still a bit rusty in using it. Is there any way to get you >> access to the new object branch? (this question is directed at project >> admins btw). > > Thanks very much for committing that. I know what you mean about svn, I > tend to use git to track everything, and then it can just push back into > svn when it needs too (and it'll remind you if you missed a file, just > like hg!). 5;) > >> Ahh the linux tasks is really not even integrated at all yet. Its kind >> of neglected since noone seems to be interested in linux atm :-(. > > I think Jon (echo6) might be interested in the Linux side of things. > I've also got the old truecrypt plugin on look at on my todo list (way, > way down on my todo list, but there at least), so we might be able to > help bolster that. It might be more worthwhile persuing the Mac OS > X/BSD side of things though, given the distribution of machines people > might run up against (particularly if people start looking at iPhones on > ARM)... 5:) > >> heh - see here is my svn ignorance showing again - svn doesnt >> automatically tell you you missed adding a file as far as i can see >> (like hg does) - sorry I forgot to add that file. > > No problem, thanks for adding it back in. 5:) > >> The scan2 stuff is faster because its a more optimised scanning >> technique - not really related to the new object framework. Basically >> I was going to convert all the basic modules to the new framework as >> well as we can. It will require a re-engineering of the module rather >> than just a search/replace though since the new framework is much more >> concise and readable - case in point is the example I gave previously >> of _CM_HIVE. > > Thanks, I had a go at starting to convert over some of the modules. > I've done datetime and ident for now, just to get me going. Any chance > you could take a look at them (part of the attached patch, since I > touched other bits of the tree). I'm still not fully up to speed on > everything, so any criticisms would be greatly appreciated! 5:) > >> It will be clearer quite quickly which ones we need and which are not >> so needed - e.g. the pstree one is basically pslist with some extra >> stuff. If you look at the memory_objects//Windows/xp_sp2.py you can >> see that the new object classes are starting to implement their own >> methods to do stuff they want - for example to iterate over an >> _EPROCESS's handles you can just call: >> >> for h in process.handles(): >> xxx >> >> this basically obsoletes Volatility/forensics/win32/handles.py > > That's very cool! The next step I guess will be to start removing the > older/unnecessary stuff to clear it all up. 5:) > >> Thats a great idea - although better than a single version string it >> might be better to implement separate versions for each subsystem and >> let the plugin decide if its ok to work with - e.g. new_object_version >> 1.0 etc. Maybe just have a version in the command class? > > Yep, that seems reasonable. The command class can keep a requirements > list of features, and the framework can check it satisfies them all. > That will allow for newer versions and new features, and to gracefully > deprecate then remove old versions. > >> It might work this way im not sure - but the intension is to produce >> better code, so I would suggest a better replacement for each plugin >> should be written in the spirit of the new object design. > > Absolutely, as I say, I've started with the easy ones, but I have every > intention to moving getting rid of vmodules (and then clearing out as > much of the win32.* as are no longer necessary/use the old object model. > >> Oh i wrote a page about it once - >> http://www.pyflag.net/cgi-bin/moin.cgi/Volatility_Object_Framework >> >> This is just me playing around and not any "official" way to generate >> vtypes. It should probably be added to the repo. > > Brilliant, that's just the kind of documentation I was looking for. It > gives a good overview of what's going on. Thanks! 5:) > >> Developement typically occured ad hoc and people >> needed to essentially patch the framework as well as provide plugins >> which sort of defeats the whole point of plugins. One of the problems >> has been the inability to add complex vtype handling via plugins - a >> problem which is addressed in the new branch. > > The overlay idea looks really good, but I'm still a little unclear how > to integrate it cleanly (ie, how to have it affect just a single module, > in case one overlays changes that break another)... > >> ## Maintained for backward compatibility do not use in new code > > Yeah, I saw that, it was just still used all over the place, and unless > it goes away, I think people will keep using it... 5:( > >> I was a bit reluctant to completely remove old object support - but I >> think I might need to do that to make it clear what files are going to >> be removed. > > Yeah, I think so too, but it should make everything a lot easier to > follow (and much easier to document!). 5:) > > Mike 5:) >

15 years, 9 months

2
1
0 0

[patch] Pylint improvements for new_object

by Mike Auty

Hi guys, Here's another pylint patch, much of it the same as the last one, but this one applies to the new_object branch (it's probably a bit better than the last one). new_object requires utils.py[1] and linked_lists.py[2] to work, and the patch requires their presence. Please be aware, I don't have a complete library of images to test this stuff against, so whilst none of the changes should break anything, if they do, please let me know and I'll be happy to fix them up (particularly if you've got an image I can test them against!). 5:) I think the load_as function from utils.py (which makes use of the new address_space voting scheme that scudette wrote) will make a huge difference to the duplication going on in all the plugins, so my next step is going to be converting vmodules.py into individual plugin files, and then converting each one to use the new address_space system. Once I get good at that, I can start taking on externally written plugins, if it'll help? I think maintaining backwards compatibility will clutter an already complicated layout, so I'd sooner offer my time to convert other people's plugins, than try and maintain two mechanisms side-by-side and hope people don't get confused about which one they should be using. With the namespace cleanup happening anyway, this seems like an ideal time to drop any deprecated code, unless people think otherwise? After that, I'm going to have a go at converting them from Object to NewObject calls. Does anyone know whether NewObject is a drop in replacement for Object, or if there are specific changes required (such as, does NewObject require Profiles, or will it still work with normal types arrays)? Also, I wondered what people's thoughts were (as a long term goal) on integrating the Object2/NewObject code with the object code, so that all the familiars like read_string and so on, would be done through the one single object model? So, once all the modules are in their own individual files, and the imports are all explicit, it should become much easier to move things around, and get volatility into it's own namespace. Once that's been done, I'll probably do a sweep over the code changing all the direct imports (from blah.mumble import foo) to slightly more explicit ones (import blah.mumble) or similar. The reason I'd do this is because the imports were all over the place (as evidenced by the fact that not one internal plugin imported forensics.commands!), and the namespaces were getting messed up (so most of the plugins were importing gmtime from other volatility modules, rather than from time itself). The main question becomes, would it be tedious/ugly to have such long names (like "volatility.forensics.win32.tasks.process_handle(blah)") or are they not called often enough to make coding cumbersome? What do people think? That should cover the first three items on the todo list[3], and four and five I've got existing code[4] that should get everything sorted with the installation system, and allow volatility.exe binaries to be created (there'll need to be some code modifications to allow plugins to be dropped into directories external to the executable, but that's all doable)... Then it's just merging the linux stuff in (where does that come from?) and lots and lots and lots of documentation!!! Anyone want to help out with that? It'd really help to have some words about how scudette's NewObject system works from anyone who understands it... 5:) Mike 5:) [1] http://www.pyflag.net/pyflag/src/plugins/MemoryForensics/Volatility-1.3_Lin… [2] http://www.pyflag.net/pyflag/src/plugins/MemoryForensics/Volatility-1.3_Lin… [3] http://code.google.com/p/volatility/wiki/ToDo14 [4] http://phormat.svn.sourceforge.net/viewvc/phormat/trunk/phormat/setup.py?re…

15 years, 9 months

2
4
0 0

Finding Truecrypt passphrases

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello Jesse, hello list, today I have given a try to the cryptoscan-plugin. The dump comes from an XP with SP3. That should not be problematic because the structure the plugin looks for is os-independent, isn't it? In the case I forced Truecrypt (v6.2a) to cache the passphrases in memory I saw it as plain text: XWF was not able to allocate that offset (phys. 0x18218c84) to a single process. But I was not able to find the described structure neither with the plugin nor manually. The dump is from a test case I use for forensic classes. So I could provide it for further analysis. It additionally includes cached domain credentials, waiting for extraction.. Cu Michael

15 years, 9 months

2
1
0 0

Re: Pylint and code questions

by Michael Felber

Hello Mike, thanks a lot for the efforts you spent on that code optimization. I am a programming noob (I am a forensics guy) but will look at it too to learn. The firewire-access is quite funny but doesn't work with Vista at the moment (the raw1394 is unable to see the Vista PC). I have applied an extension (idea found at https://www.moonloop.org/bin/view/Moonloop/Stream?tag=ida) to winlockpwn so it works fine with any uptodate SP3 system I have testet. But a live analysis of the memory may be not the best idea because its to volatile, even a memory dump is not as consistent as a hiberfil.sys or memory.dmp would be. I would suggest making a memory dump first before analysis, except code injection techniques. ;-) Btw. Do you know how to extract the LSA-key from a SP3 registry, see cachedump.py. Jon, F-Response is a real great tool, you're right. It uses the iSCSI-protocol for communication and silently drops every write attempt. Both ways (FW / iSCSI) give the investigator the unlimited remote access to the 'living' memory of the target. F-response prevents writing but needs it own memory space, firewire does create a new device on the target system but does not consume memory. The main danger for changing evidences is its ability to write to the target. Cu Mic -- Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3 - sicherer, schneller und einfacher! http://portal.gmx.net/de/go/chbrowser

15 years, 9 months

4
5
0 0

Pylint and code questions

by Mike Auty

Hiya guys, First off thanks for the warm reception, everyone's been really friendly on IRC, etc. It feels like a really nice community. 5:) People on IRC suggest that the mailing list really is the right place for patches (even code clean-up patches), so I've unleashed my giant pylint patch on it. As I mentioned I've run pylint against most it (I use pydev with eclipse, which has pylint support built in, and went through all the files). Unfortunately that led to a horribly large 6000+ line patch (attached) and I'm really, really sorry it's such an unweildy nasty patch. 5:( It applies to the current volatility HEAD (r16), but it has a *lot* of changes it in, so I'd really appreciate it if someone could look over it (with me, if that helps). Mostly they should be indentation, spacing, unused imports and unused variables, but it could be that the change to explicit imports or prepending unused variable names with an _ might have an unexpected effect. I don't have that many memory images to run this against, so anyone who has more do please let me know if there's any problems. It might be easiest if I cut this down into file-by-file patches (although scan.py and vmodules.py were both huge). Would that be useful, or are people happy to deal with it as is? I did spot a couple of issues as I was going through, there's a method without the self argument in addrspace, and a few others which I was able to fix myself. Some of them though I don't know the code well enough to sort myself and I've listed here: * In scan.py, check_connection_poolprevioussize, seems always to return False, and sets PreviousSize seemingly for no reason, does the function have side effects besides simply returning? * In scan2.py, BaseMemoryScanner.Process uses a default value of {} which is generally a bad idea (having a mutable object as a default means that it may not always be what you expect when you call the function[1]). This turned up in a few other places later on as well, but I think I've fixed those up. * In tasks.py, find_dtb appears to reopen an existing address space rather than using the one it was provided with, and I can't quite figure out why? * In object.py, get_obj_offset, there's a variable that could potentially be used before it's defined (I think it's conditional and gets defined lower in the loop, so as long as the condition is never met first time round, everything will work fine). Is there a coding standard or anything that you guys are working to? So, yeah, I'm not sure the best way of approaching all this, but I thought I'd best post it to get it out there. I've also got a fair few questions about some bits and pieces I'd like to work on (with varying levels of viability) include: * Removing the big chunks of data table sat in crash_dump.py (I've already slimmed them down in another patch that'd need applying after the pylint patch, but I'm thinking of loading it all from a resource file or something). * I'd also like to remove the use of globals. I haven't figured out exactly where this gets used (it seems mostly to be various tables in meta_info.py), but I think it's generally discouraged. * It felt like there was an awful lot of repetition going on in vmodules.py, and I wondered if the functions couldn't be turned into classes and dumped in an internal-plugins location, to save hardwiring in everything in to "modules" at the start of the volatility script. * Also, the namespace seemed a bit all over the place, format_time was defined in two places, and most of the scripts seemed to just "from forensics.win32.blah import *", which imported all the imports, so lots of them were getting gmtime and strftime from modules other than time. Unfortunately I'm not around much this weekend, so if there's any issues or fixes or anything, they'll have to wait until Sunday, but hopefully I'll chat to people on the list or IRC. Thanks, Mike 5:) [1] http://effbot.org/zone/default-values.htm

15 years, 9 months

2
1
0 0

Plugin input mechanism

by Mike Auty

Hiya guys, I'm pretty new here, so forgive me for bursting in and asking lots of questions, but I'm trying to get used to the codebase (I've had some fun running pylint across this, which helped a *lot* with trying to figure out what went where). I'd really like to add a layer that allows the existing volatility tools to be run against a live system, directly via firewire (ie, without having to completely image the system first). I should probably mention now that I'm from a penetration testing background, rather than a forensics background, but that I've been investigating the firewire technique metlstorm developed for a while now. My hope is that some of the hash dumping tools and similar might be much quicker when run directly, rather than having to image the entire system first, and that it might also help the volatility suite be used as a live debugging aide for people trying to learn about memory and how it works. It seemed as though everything was laid out nicely, so I'd just need to implement a FirewireAddressSpace object (which I've done, and attached, although I have yet to test it). The problem I found was that all forensics.commands.command subclasses appear to accept an optparse parser result, and then manually open their own image based on the filename. Since most of the functions seem to operate on an AddressSpace rather than on a filename string, it seemed as though it should be possible to pass that into the plugins/commands. So that leads me to a few questions: * Would it be worthwhile reworking the module system to allow modules to specify their requirements more abstractly (I need a memory image, I need a set of registry keys, etc)? * Would it need to be that abstract, or do pretty much all modules always act on an AddressSpace? * How are you guys intending to deal with upgrading plugins after a major enhancement (I noticed plugins are already getting a bit out of hand, since Andreas' plugins require overwriting bits of volatility with his own versions)? * Would it be a major version number bump with an API break, and if so are there any other changes that would be worthwhile addressing at the same time? * Should I investigate allowing multiple plugin versions to co-exist? In implementing a new AddressSpace, I also spotted this fast variable, that appears simply to open a new handle, and I can't figure out how that helps or makes it faster? Was this a place holder for a possible address space enhancement, or is there really some kind of speed-up which I'm missing? Sorry to kind of drop all this here, but it seemed the most appropriate place for it. I've joined the IRC channel as well, so if you want to poke me for not doing things sensibly, you'll find me on there as ikelos... 5:) Thanks, Mike 5:) diff --git a/Volatility/forensics/addrspace.py b/Volatility/forensics/addrspace.py index d0c0dee..8697f71 100755 --- a/Volatility/forensics/addrspace.py +++ b/Volatility/forensics/addrspace.py @@ -30,6 +30,7 @@ """ Alias for all address spaces """ import os +import sys import struct try: @@ -73,7 +74,7 @@ class FileAddressSpace: return False return addr < self.fsize - 1 - def close(): + def close(self): self.fhandle.close() class BufferAddressSpace(FileAddressSpace): @@ -85,3 +86,103 @@ class BufferAddressSpace(FileAddressSpace): if fast == True: self.fast_fhandle = StringIO(buf) + +try: + import firewire +except: + pass + +if 'firewire' in sys.modules: + + def intervals(exclusions, start, end): + """Returns a list of intervals, from start to end, that do not include the exclusions""" + return _intervals(sorted(exclusions), start, end, []) + + def _intervals(exclusions, start, end, accumulator): + """Accepts a sorted list of intervals and a start and end + + This will return a list of intervals between start and length + that does not contain any of the intervals in the list of exclusions. + """ + if not len(exclusions): + # We're done + return accumulator + [(start, end)] + + e = exclusions[0] + estart = e[0] + eend = e[1] + + # e and range overlap + if not (eend < start or estart > end): + # Ignore this exclusions + return intervals(exclusions[1:], start, end, accumulator) + if estart < start: + if eend < end: + # Covers the start of the remaining length + return intervals(exclusions[1:], eend, end, accumulator) + else: + # Covers the entire remaining area + return accumulator + else: + if eend < end: + # Covers a section of the remaining length + return intervals(exclusions[1:], eend, end, accumulator + [(start, estart)]) + else: + # Covers the end of the remaining length + return accumulator + [(start, estart)] + + class FirewireIO(object): + """File-like interface for Firewire devices""" + def __init__(self, bus, node): + self.offset = 0 + self.fsize = 4 * 1024 * 1024 * 1024 + self.closed = False + self._exclusions = [(0xa0000, 0xfffff, "Upper Memory Area")] + try: + h = firewire.Host() + self._node = h[bus][node] + except IndexError: + raise IOError, "Firewire node " + str(node) + " on bus " + str(bus) + " was not accessible" + + def close(self): + """Close function for file-like interface""" + self.closed = True + + def flush(self): + """Flush function for file-like interface""" + pass + + def read(self, size = -1): + if size < 0: + size = self.fsize + ints = intervals(self._exclusions, self.offset, self.offset + size) + output = "\x00" * size + for i in ints: + output = output[: i[0] - self.offset] + self._node.read(i[1] - i[0], i[0]) + output[i[1] - self.offset:] + return output + + def seek(self, offset, whence = os.SEEK_SET): + """Seek function for file-like interface""" + self.offset = offset + if (whence == os.SEEK_CUR): + self.offset += offset + elif (whence == os.SEEK_END): + self.offset = self.fsize - offset + + def tell(self): + """Tell function for file-like interface""" + return self.offset + + def write(self, string): + pass + + class FirewireAddressSpace(FileAddressSpace): + def __init__(self, bus, node, fast=False): + self.fname = "Firewire on bus " + bus + " node " + node + self.name = self.fname + self.fhandle = FirewireIO(bus, node) + # Theoretical limit + self.fsize = self.fhandle.fsize + + if fast == True: + raise RuntimeError("Fast mode for firewire not implemented") \ No newline at end of file

15 years, 9 months

1
0
0 0

AW: CashDump-Issue

by Michael Felber , Steufa Chemnitz, IT-Forensik

Oh, oh, forget my last posting: I've used the wrong offset for the SECURITY-Hive within that example. SORRY. Using an older SP2-dump it worked fine. Found no wrong code within the script. ;-) But the script was not able to extract the LSA key from a SP3-dump. Does anyone have a solution for that? How the LSA key may get extracted otherwise? It MUST be somewhere in the lsass-process, right? TNX in advance and sorry for the wrong posting again. Cu Michael Von: Michael Felber , Steufa Chemnitz, IT-Forensik [mailto:MichaelFelber@gmx.net] Gesendet: Donnerstag, 10. September 2009 16:42 An: 'vol-dev(a)volatilityfoundation.org' Betreff: CashDump-Issue Hello, according a hint of Andreas (TNX!!) I've tackled the problem of extracting cached domain credentials from a memory-dump. At the end of my path of epiphany I saw that Volatility already has a plugin doing that: hashdump.py. Great. While giving it a try I only got error messages like Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 215, in main command.execute() File "memory_plugins\registry/hashdump.py", line 78, in execute dump_memory_hashes(addr_space, types, self.opts.syshive, self.opts.samhive, prof) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 305, in dump_memory_hashes dump_hashes(sysaddr, samaddr, profile) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 289, in dump_hashes bootkey = get_bootkey(sysaddr,profile) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 131, in get_bootkey class_data = sysaddr.read(key.Class, key.ClassLength) AttributeError: 'NoneType' object has no attribute 'Class' >From my point of view as a programming noob some type of type declaration is missed. Or did I miss something? I have applied all the recent patches posted in this list. The full console dump is attached for kindly being reviewed. Cu Mic

15 years, 9 months

1
0
0 0

CashDump-Issue

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello, according a hint of Andreas (TNX!!) I've tackled the problem of extracting cached domain credentials from a memory-dump. At the end of my path of epiphany I saw that Volatility already has a plugin doing that: hashdump.py. Great. While giving it a try I only got error messages like Traceback (most recent call last): File "volatility", line 219, in <module> main() File "volatility", line 215, in main command.execute() File "memory_plugins\registry/hashdump.py", line 78, in execute dump_memory_hashes(addr_space, types, self.opts.syshive, self.opts.samhive, prof) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 305, in dump_memory_hashes dump_hashes(sysaddr, samaddr, profile) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 289, in dump_hashes bootkey = get_bootkey(sysaddr,profile) File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 131, in get_bootkey class_data = sysaddr.read(key.Class, key.ClassLength) AttributeError: 'NoneType' object has no attribute 'Class' >From my point of view as a programming noob some type of type declaration is missed. Or did I miss something? I have applied all the recent patches posted in this list. The full console dump is attached for kindly being reviewed. Cu Mic

15 years, 9 months

1
0
0 0

Re: Patch: strings command optimization

by Jamie Levy

Kind of diverging from the topic at hand, but: > sed 's/ /:/' > > to do the conversion myself. (Note that sed will only perform one > replacement per line by default.) You can do global replacement like so: sed 's/ /:/g' All the best, -Jamie

15 years, 9 months

3
3
0 0

Patch: strings command optimization

by Tim

Hello, Please find attached a patch to speed up the Volatility strings command. On my slow laptop, a particular search for a single string required around 2 hours and 25 minutes. After these changes, the same search requires 35 minutes. (Measured in wall clock time.) Notable changes include: - Switched from guess-and-check style address probing (during the reverse map construction) to using get_available_pages(). On my test image, this cuts the number of vtop() calls down from 1M to something on the order of 55K for each process. This more than made up for the additional overhead of calling get_available_pages(). - The above change also eliminates a 32bit address space assumption appearing in top-level code, which I assume is a good thing. - Reduced the number of reverse_map lookups - Moved parsing of the strings input file to an earlier point in processing so users don't have to wait until the end of the job to discover they didn't specify things correctly. I can think of several other ways to make this faster and/or more memory efficient, but most require changes to the address interface (ever thought of providing a page iterator?). Also, I added a few comments for future improvements to the user interface and output. I think currently there are problems with the way that addresses appearing in large pages are reported, but I'm not 100% sure what the output is intended to mean, so I just kept it the same for now. DISCLAIMER: This is the first time I've seriously looked at the Volatility code. Please review/test it carefully before committing the changes. thanks! tim

15 years, 9 months

3
3
0 0

latest

by zahra zohoor

Hi, what are the latest enhancements made to Volatility in Windows platform? Best regards Zahra

15 years, 9 months

1
0
0 0

BufferAddressSpace Bug

by Jesse Kornblum

Hi everybody, My apologies if this has been addressed in a previous patch, but I had a Volatility crash today. The system died because a module created a BufferAddressSpace of n bytes and then attempted to read greater than n from it. The problem appears to be a lack of checks in the FileAddressSpace class that the requested address to read from exists in the file (or buffer). Here's a patch to fix it: $ svn diff forensics/addrspace.py Index: forensics/addrspace.py =================================================================== --- forensics/addrspace.py (revision 16) +++ forensics/addrspace.py (working copy) @@ -1,6 +1,6 @@ # Volatility # Copyright (C) 2007,2008 Volatile Systems -# + # Original Source: # Copyright (C) 2004,2005,2006 4tphi Research # Author: {npetroni,awalters}(a)4tphi.net (Nick Petroni and AAron Walters) @@ -51,15 +51,28 @@ return self.fast_fhandle.read(len) def read(self, addr, len): + ''' + Read and return len bytes from the address addr. + If any of those bytes are not available, return None. + ''' + if not self.is_valid_address(addr): + return None self.fhandle.seek(addr) return self.fhandle.read(len) def zread(self, addr, len): - return self.read(addr, len) + ''' + Read and return len bytes from the address addr. + If any of those bytes are not available, return len bytes of zeros. + ''' + tmp = self.read(addr, len) + if tmp is None: + return '\x00' * len + return tmp def read_long(self, addr): string = self.read(addr, 4) - (longval, ) = struct.unpack('=L', string) + (longval, ) = struct.unpack('<L', string) return longval def get_address_range(self): -- Jesse Kornblum

15 years, 10 months

1
0
0 0

Patch for wake hibernation files

by Jesse Kornblum

Hi everybody, I've found that if you interrupt the hibernation file restore on Windows XP the header changes from "hibr" to "wake". Unfortunately such hibernation files cannot be processed by Volatility due to a simple check in vutils.py. The code attached patches vutils to allow parsing of these files. -- Jesse

15 years, 10 months

1
0
0 0

Drop-in replacement for x86.py

by Jesse Kornblum

Hi everybody, Attached please find a drop-in replacement for forensics/x86.py. It's a complete rewrite of the code using the latest edition of the Intel Architectures Software Developer's Manual [1]. The manual, now at revision 031, has changed significantly over the past few years. The current version has a new (and much simpler) approach for finding offsets. The result is cleaner code! Hopefully this will be easier to maintain over the years! I've also added pydoc style documentation for each function. Please let me know what you think, [1] http://www.intel.com/products/processor/manuals/index.htm -- Jesse research(a)jessekornblum.com

15 years, 10 months

1
0
0 0

Simplifying address translation

by Jesse Kornblum

Hi everybody, We might be able to simplify the virtual to physical address translation in the Volatility framework. While it's not always wise to mess with something that works already, making this code clearer would help people trying to learn the framework and about memory forensics in general. The code in question is all in forensics/x86.py. I've attached a drop-in replacement for forensics/x86.py to illustrate the kind of changes I'm proposing [1]. Right now it only works for non-PAE system (e.g. xp-laptop-2005-*). If you like this I can expand it work on PAE systems as well. I was reading the Intel Architectures Software Developer's Manual [2] and took particular note of how they described the lookups for PDEs and PTEs. Using PDEs, for example, Volatility uses the value in CR3 as a base address and add to it an index number multiplied by a size value. The index comes from shifting bits around in the original virtual address. It looks like this: address = [Cr3] + (([vaddr] >> shift) & ((ptrs - 1)) * pointer_size) This calculation is broken into two functions and uses three magic values. The Intel manual takes a different approach. To them the PDE offset just a series of bits grabbed from various sources. In their words: <snip> A PDE is selected using the physical address defined as follows: — Bits 39:32 are all 0. — Bits 31:12 are from CR3. — Bits 11:2 are bits 31:22 of the linear address. — Bits 1:0 are 0. </snip> In other words: address = ([Cr3] & mask) & ([vaddr] & mask >> shift) In Volatility it would look like: pgd_addr = (self.pgd_vaddr & 0xfffff000) | ((vaddr & 0xffc00000) >> 20) I've even included a helper function, bitmask(), that computes bitmasks on the fly. Avoid it might take slightly longer to execute, it would hopefully avoid coding errors. pgd_addr = (self.pgd_vaddr & bitmask(12,31)) | ((vaddr & bitmask(22,31)) >> 20) What do you think? [1] Warning! This code *only* works on non-PAE systems for now. It also contains some code to make Volatility work on big endian machines. [2] http://www.intel.com/products/processor/manuals/index.htm -- Jesse research(a)jessekornblum.com

15 years, 10 months

1
0
0 0

Re: [Vol-dev] decompression of hyberfil.sys

by Andreas Schuster

All, Here's a follow-up on the hiberfil.sys decompression issue. I executed the test plan as it was previously posted to vol-users (see <http://lists.volatilityfoundation.org/pipermail/vol-users/2009-July/000115.…>). As Michael already reported on this list, Volatility and X-Ways Forensics produced identical decompressed images from the original hiberfil.sys. Each of the memory images (VMEM files and decompressed hiberfil.sys) contains 32739 pages. Hibernation is known to preserve only important parts of the system's memory (see <http://technet.microsoft.com/en-us/library/bb457057.aspx>). >From the 32739 pages, only 19158 (59%) were unaltered after the system returned from hibernation mode (prehib.vmem vs posthib.vmem). The decompressed hibernation file matched 18566 pages (57%) of physmem prior to hibernation and 27929 pages (85%) of physmem post hibernation. >From those 19158 pages that are "stable" (unchanged over the whole process), 17998 (94%) are present in the decompressed hibernation file. Of those 3657 pages are filled with zeros. What about the remaining 6%? I suppose these pages are in use by the boot loader, HAL, or parts of the kernel. AAron suggested to analyze the process memory instead of physical memory. A quick stab (using Volatility's memdmp module) produced the following output for a command console: 44.322.816 bytes from prehib.vmem 46.036.628 bytes from hiberfil.sys 49.815.552 bytes from decompressed hiberfil.sys 39.624.704 bytes from posthib.vmem I ran nwdiff on the resulting images and all I can say is that the process environment is unchanged. Obviously, more work is needed to get a meaningful result. I suppose to focus on the user-land portion of the address space, calculate the pages's md5sum, and keep an eye on PTE flags as well. Please keep in mind that the figures above are based on a single execution of the test plan only. Multiple runs, with different memory loads and system memory sizes may yield different results. Cheers, Andreas

15 years, 11 months

1
0
0 0

Timeszones

by Andreas Schuster

Dear developers, I noticed that Volatility displays dates and times in up to three different timezones: 1. UTC (e.g. pslist, sockets, and the corresponding scanner modules) 2. local time of the system under examination (e.g. datetime, ident commands) 3. local time of the examiner's workstation (when using ctime() for formatting) I usually prefer UTC, especially when I have to consolidate timelines across systems that are distributed across different timezones. Using the local time may be a good choice when dealing with less-technical people. So, I don't think there's a "best" option and propose to let the user decide about the timezone that best suits his/her needs. The handling (and output format) should be consistent to avoid any misinterpretation and confusion. In order to provide a consistent interface to users and programmers, I propose to add functions to the framework (or to modify existing functions, respectively): - to switch between the three options in a consistent way (i.e. add an option to the standard parser) - to read timestamps in all applicable formats (mostly KSYSTEM_TIME, but also LARGE_INTEGER with bit shifting) from buffers and address spaces (see forensics/win32/datetime.py) - to produce the timestamp in an easy to read, unambiguous, and sortable format (preferably in accordance with ISO 8601) Before I start with coding, I want to hear your opinion on this. I appreciate any comments. Thanks! Andreas

15 years, 11 months

3
2
0 0

decompression of hyberfil.sys

by Michael Felber , Steufa Chemnitz, IT-Forensik

Hello all, I have posted this twice because the decompression issue should be moved to vol-dev as Aaron suggested. yesterday Andreas did provide a hiberfil.sys for decompression testing. Thanks a lot again. I have processed it twice with X-Ways-Forensics 15.3 SR3 and Volatility (SVN-release). The good news: Both result files are identical. The bad news: I dont have any clue why the decompression of my case relevant hiberfil.sys did not properly work with volatility but did with XWF. If anyone other needs a hiberfil.sys decompressed with XWF for testing, do not hesitate to ask me. We have the most recent releases here. (I am back on the 29th of July) I did compare the vol and the XWF-version of my case files but I cant interpret or explain the differences. What should I look for? BR Michael Michael Felber, StA Finanzamt Chemnitz-Süd Steuerfahndung IT-Forensik Paul-Bertz-Str. 1 D-09120 Chemnitz Germany Fon: +49 371 279 446 Fax. +49 371 279 421

15 years, 11 months

2
1
0 0

_LDR_MODULE

by Andreas Schuster

All, While fixing some bugs in scan2.py, I noticed a reference to _LDR_MODULE. I have never seen that name in a PDB before, possibly it should read _LDR_DATA_TABLE_ENTRY instead. Or is there a subtle difference that I'm not aware of? Both structures are defined in vtypes.py of SVN rev 12. I suggest to remove _LDR_MODULE and change any references to it into _LDR_DATA_TABLE_ENTRY. At least we should add a comment in order to avoid confusion. Any comments on this? Cheers, Andreas

15 years, 11 months

2
1
0 0

Fix to scan2.py (SVN rev 12)

by Andreas Schuster

All, Attached please find a fix for a couple of stupid mistakes (introduced by yours truly) in scan2.py, as of SVN rev. 12. Cheers, Andreas

15 years, 11 months

2
1
0 0

Little enhancements to datetime and thread scanners

by Andreas Schuster

Attached please find two patches for "datetime" and the thread scanner modules. Diffs are against SVN version 12. I modified the modules for my classes, so students could get some additional data to populate their timelines. The "datetime" function now reports the system's time in UTC, too. Both thread scanners now report creation and exit times in UTC. Cheers, Andreas

15 years, 11 months

1
0
0 0

SVN repository

by Jesse Kornblum

My apologies if this has been posted before, but the source code for Volatility is being hosted on Google code, http://code.google.com/p/volatility/ . You can check out a read-only version of code using Subversion using the command: svn checkout http://volatility.googlecode.com/svn/trunk/ volatility- read-only cheers, -- Jesse research(a)jessekornblum.com

15 years, 11 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-dev