Hello Group,
So am not sure, if I understood, the working of ldrmodules correctly, but
in short, for each process, I imagine it looks at the VAD; and for each dll
found there compares it with the 3 lists in the process PEB and reports
back on any discrepancy.
A snippet, from vadinfo for a process with pid 12128, I can see a dll mapped
VAD node @ 0xfffffa80088378c0 Start 0x0000000000040000 End
0x0000000000040fff Tag Vad
Flags: Protection: 7, VadType: 2
Protection: PAGE_EXECUTE_WRITECOPY
Vad Type: VadImageMap
ControlArea @fffffa8006a86c40 Segment fffff8a00021d4e0
Dereference list: Flink 00000000, Blink 00000000
NumberOfSectionReferences: 1 NumberOfPfnReferences: 1
NumberOfMappedViews: 119 NumberOfUserReferences: 120
WaitingForDeletion Event: 00000000
Control Flags: File: 1, Image: 1
FileObject @fffffa80069c5250, Name: \Windows\System32\apisetschema.dll
First prototype PTE: fffff8a00021d5a8 Last contiguous PTE: fffffffffffffffc
Flags2: Inherit: 1
But ldrmodules (or dlllist) over the image, does not show that dll.
cat ldrmodules.txt | grep -i apiset
cat dlllist.txt | grep -i apiset
The process in question has a pid of 12128, so on a frequency count, there
is a large discrepancy, that I don't understand why.
cat ldrmodules.txt | grep 12128 | wc -l
54
cat vadinfo-12128.txt | grep dll | wc -l
130
Any pointers to a link I should read up on to understand the concepts here.
Should not have ldrmodules, reported on all the dlls that were found as
mapped files in the VAD ?
Thanks,
JB
Does Volatility support the analysis of Mac /var/vm/sleepimage?
I did not see it mentioned in "The Art of Memory Forensics", and I
seem to have trouble even doing a simple mac_pslist against it...
--
Jarle Thorsen
vol-users,
The registration for the Open Memory Forensics Workshop (OMFW) 2014 closes
on Oct 24. If you are still planning to attend, I recommend sending a
request as soon as possible. There are less than 10 open seats remaining!
For those who have already requested an invitation, please let us know if
you have not received your registration details.
Reserve your seat by sending an email to info [at]
volatilityfoundation.org or using the contact form on the Foundation's
website.
Thanks,
The Volatility Foundation
www.volatilityfoundation.org
We are excited to announce that we now have public trainings scheduled
through May of next year. Between now and then we will be visiting
Austin (Dec.), San Francisco (Jan.), Brazil (Feb.), Reston, VA (April),
and New York (May). A complete listing of course offerings and details
can be found at:
http://www.memoryanalysis.net/#!memory-forensics-training/c1q3n
and:
http://volatility-labs.blogspot.com/2014/10/windows-malware-and-memory-fore…
Classes fill quickly so please contact us ASAP if you would like to
attend! We offer discounts for LEO, government, and full time students
as well as group rates for companies.
--
Thanks,
Andrew (@attrc)
Hi all,
I have acquired an android RAM image by using Lime and now I am using
volatility to analyze it. I have created a profile and can now list
processes, etc. What I need to do is inspect an integer array of a kernel
module, which I have the address. I tried using volshell's dd() but I
believe it is not showing the correct values. How can I certify that the
virtual address is being calculated correctly by volatility?
Thanks in advance,
Felipe
I have a .vmem file from a Mac OS virtual machine. I'm using profile
"MacMountainLion_10_8_2_AMDx64"
Using Volatility 2.4, I'm able to run a few mac commands against this
image, however I get traceback errors in the 'netstat' and 'arp' commands.
I paste below:
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_ifconfig
Volatility Foundation Volatility Framework 2.4
Interface Address
---------- -------
lo0 fe80:1::1
lo0 127.0.0.1
lo0 ::1
gif0
stf0
en0 00:0c:29:ea:9a:27
en0 fe80:4::20c:29ff:feea:9a27
en0 172.16.253.140
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_version
Volatility Foundation Volatility Framework 2.4
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012;
root:xnu-2050.18.24~1/RELEASE_X86_64
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_netstat
Volatility Foundation Volatility Framework 2.4
Proto Local IP Local Port Remote IP Remote Port
State Process
------ -------------------- ---------- -------------------- -----------
-------------------- ------------------------
UNIX -
UNIX /var/tmp/launchd/sock
UNIX -
UNIX /var/run/com.apple.ActivityMonitor.socket
UNIX /var/run/mDNSResponder
UNIX /var/rpc/ncacn_np/lsarpc
UNIX /var/rpc/ncalrpc/lsarpc
UNIX /var/rpc/ncacn_np/mdssvc
UNIX /var/rpc/ncalrpc/NETLOGON
UNIX /var/rpc/ncacn_np/srvsvc
UNIX /var/rpc/ncalrpc/srvsvc
UNIX /var/rpc/ncacn_np/wkssvc
UNIX /var/rpc/ncalrpc/wkssvc
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in
<module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py",
line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py",
line 127, in execute
func(outfd, data)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/netstat.py",
line 58, in render_text
self.table_row(outfd, proto, lip, lport, rip, rport, state,
"{}/{}".format(proc.p_comm, proc.p_pid))
ValueError: zero length field name in format
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem
--profile=MacMountainLion_10_8_2_AMDx64 mac_arp
Volatility Foundation Volatility Framework 2.4
Source IP Dest. IP Name Sent
Recv Time Exp. Delta
------------------------ ------------------------ ----------
------------------ ------------------ ------------------------------
---------- -----
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in
<module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py",
line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py",
line 127, in execute
func(outfd, data)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/mac/route.py",
line 104, in render_text
rt.name,
File "/home/forensics/programs/volatility-2.4/volatility/obj.py", line
537, in __getattr__
return getattr(result, attr)
File
"/home/forensics/programs/volatility-2.4/volatility/plugins/overlays/mac/mac.py",
line 562, in name
return "{}{}".format(self.rt_ifp.if_name.dereference(),
self.rt_ifp.if_unit)
ValueError: zero length field name in format
++++++++++++++++++++++++++++++
Any thoughts or ideas are very appreciated!
--
Andre' M. DiMino
DeepEnd Research
http://deependresearch.orghttp://sempersecurus.org
"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)
I just build a VM with Debian (I needed to install other packages) and when I run this on a memory image I get the following (after about 10 minutes). The pslist.txt file is partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py", line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
