- Vol-users - volatilityfoundation.org

by Ayers, Robert

Anyone ever seen anything like this? It came out of a WinXPSP3x86 ram capture. PCSXView results; Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ---------- -------------------- ------ ------ ------ -------- ------ ----- ------- -------- 0x0a074da0 X???E?P??(O'? 23...6 False True False False False False False PSSCan results; Offset(P) Name PID PPID PDB Time created Time exited ---------- ---------------- ------ ------ ---------- ------------------------------ ------------------------------ 0x0a074da0 X???E?P??(O'? 23...6 23...4 0x8a274dc0 Thanks, Robert Ayers,

12 years, 6 months

2
1
0 0

hibernation file - imagecopy

by kongo sec

Hi I am running - revision 3164 I get the following error when running: Ignore the import errors # python2.7 vol.py -f /opt/hiberfil.sys --profile=WinXPSP3x86 imagecopy -O /opt/winxp_sp3_2nd.raw Volatile Systems Volatility Framework 2.3_alpha *** Failed to import volatility.plugins.zeusscan1 (AttributeError: 'module' object has no attribute 'ImpScan') *** Failed to import volatility.plugins.zeusscan2 (AttributeError: 'module' object has no attribute 'ApiHooks') Writing data (5.00 MB chunks): |......................................................................................................................................................................................................................................................ERROR : volatility.plugins.imagecopy: Error when reading from address space I have tried coping over the .sys file twice. I generated a new .sys file and same error. It worked wonderfully on lastweek. I tried reverting back to revision 3159 and no dice. Also Oddly enough it works with an old version of volatility running on remnux. Not sure whats up. Also here is the output from imageinfo: Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86) AS Layer1 : JKIA32PagedMemoryPae (Kernel AS) AS Layer2 : WindowsHiberFileSpace32 (Unnamed AS) AS Layer3 : FileAddressSpace (/opt/hiberfil.sys) PAE type : PAE DTB : 0x9300060L KDBG : 0x80545be0L Number of Processors : 1 Image Type (Service Pack) : 3 KPCR for CPU 0 : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2013-03-05 06:26:20 UTC+0000 Image local date and time : 2013-03-05 00:26:20 -0600 thanks in advance

12 years, 6 months

2
1
0 0

Arch Linux (3.7.9-2) profile building error

by Edwin Smulders

Hi, I am trying to build a profile for the Arch Linux kernel (3.7.9-2), but I am getting this error: http://paste.ubuntu.com/5584634/ Is this a problem with newer kernels or am I doing something wrong? Cheers, Edwin

12 years, 6 months

4
4
0 0

Creating profile for android

by Pasquale Stirparo

Hi All, I'm trying to make a profile for android device. I did a memory dump with LiME of an HTC One X (Android 4.0.3, HTC Sense 4.0, kernel 2.6.39.4-g6b459dc). Now, following the instruction here https://code.google.com/p/volatility/wiki/LinuxMemoryForensics , I was trying to understand how to modify the makefile under volatility/tools/linux/ , in order to point to my kernel source. The thing is that in from my kernel source folder I couldn't find a proper value for KDIR and KVER (although they should be pretty straightforward according to their name) that would fit with the path for make command as from the following source code: pmem: pmem.c $(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build M=$(PWD) modules dwarf: module.c $(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build CONFIG_DEBUG_INFO=y M=$(PWD) modules dwarfdump -di module.ko > module.dwarf $(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build M=$(PWD) clean Did anyone ever created an android profile? Any hint? I've seen in the mailing list archive a thread "Profile (ZIP) for Android 4.0.3" from Mike (in Cc), any news about that? Thank you P. -- Pasquale Stirparo, MEng GCFA, OPST, OWSE, ECCE European Commission - JRC Joint Research Centre Institute for the Protection and Security of the Citizen (IPSC) Digital Citizen Security Unit Via E. Fermi, 2749 - TP 361 21027 Ispra (VA) - Italy PGP Key: 0x4C589FB2 Fingerprint: 776D F072 3F43 D5DE CB55 86D2 55FF 14A7 4C58 9FB2 Disclaimer: The views expressed are purely those of the writer and may not in any circumstance be regarded as stating an official position of the European Commission.

12 years, 6 months

3
10
0 0

RE: [Vol-users] Finding injected code

by James Lay

On 2013-02-27 13:51, Ayers, Robert wrote: > By name alone I'd bet a beer that this is a malicious executable > > 0x89152020 qegyas.exe 2364 2236 0 -------- 0 > 0 2013-02-27 15:08:35 2013-02-27 15:08:44 Thanks for the quick response. I believe that qegyas.exe is the injector (according to my procmon at least). Also, that process has exited, so I'm out of luck for taking a peak at it (in memory at least...happily the malware left the file on the drive :)) James

12 years, 6 months

3
3
0 0

Finding injected code

by James Lay

Hey all. Got a naughty email sent with malicious links, so I ran it in my sendbox and got an image. I'm trying to locate the injected code: Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ -------------------- -------------------- 0x89e23830 System 4 0 76 206 ------ 0 0x89c207e8 smss.exe 640 4 3 19 ------ 0 2013-02-27 22:05:55 0x89c093e0 csrss.exe 712 640 11 369 0 0 2013-02-27 22:05:59 0x89c0ab10 winlogon.exe 748 640 18 516 0 0 2013-02-27 22:06:04 0x89b72020 services.exe 792 748 16 277 0 0 2013-02-27 22:06:05 0x89bc9980 lsass.exe 804 748 18 370 0 0 2013-02-27 22:06:05 0x89d74da0 nvsvc32.exe 996 792 4 200 0 0 2013-02-27 22:06:05 0x89c067e8 svchost.exe 1056 792 19 199 0 0 2013-02-27 22:06:05 0x894dbda0 svchost.exe 1124 792 11 243 0 0 2013-02-27 22:06:05 0x894e8638 svchost.exe 1260 792 69 1188 0 0 2013-02-27 22:06:06 0x89d7a360 svchost.exe 1308 792 6 77 0 0 2013-02-27 22:06:06 0x894fa3e0 svchost.exe 1392 792 4 81 0 0 2013-02-27 22:06:06 0x89cd4c08 explorer.exe 1676 1632 23 529 0 0 2013-02-27 22:06:06 0x89af39e0 rundll32.exe 1760 1676 4 116 0 0 2013-02-27 22:06:06 0x89bdb1d0 Bootcamp.exe 1768 1676 5 246 0 0 2013-02-27 22:06:06 0x89ba7558 RTHDCPL.EXE 1788 1676 4 197 0 0 2013-02-27 22:06:06 0x89bf8c10 rundll32.exe 1800 1676 1 88 0 0 2013-02-27 22:06:06 0x89b78da0 ctfmon.exe 1828 1676 3 145 0 0 2013-02-27 22:06:06 0x89b8e620 svchost.exe 668 792 4 107 0 0 2013-02-27 22:06:17 0x89c0dc10 AppleOSSMgr.exe 716 792 3 39 0 0 2013-02-27 22:06:17 0x89ac32c8 AppleTimeSrv.ex 872 792 1 44 0 0 2013-02-27 22:06:17 0x89aca958 svchost.exe 1088 792 4 86 0 0 2013-02-27 22:06:17 0x89ad7c18 svchost.exe 1304 792 8 141 0 0 2013-02-27 22:06:17 0x89397918 wmiprvse.exe 1896 1056 6 140 0 0 2013-02-27 15:06:42 0x89152020 qegyas.exe 2364 2236 0 -------- 0 0 2013-02-27 15:08:35 2013-02-27 15:08:44 0x89160558 rundll32.exe 3032 1260 0 -------- 0 0 2013-02-27 15:08:49 2013-02-27 15:08:49 0x89399638 ntvdm.exe 3992 1676 0 -------- 0 0 2013-02-27 15:09:42 2013-02-27 15:09:43 0x8951f020 rundll32.exe 4016 1260 0 -------- 0 0 2013-02-27 15:13:51 2013-02-27 15:13:51 0x890fb648 DumpIt.exe 3720 1676 0 -------- 0 0 2013-02-27 15:13:59 2013-02-27 15:14:01 0x89124da0 DumpIt.exe 368 1676 2 68 0 0 2013-02-27 15:14:22 malfind shows the following: Process: csrss.exe Pid: 712 Address: 0x7f6f0000 Process: explorer.exe Pid: 1676 Address: 0x3d920000 Process: explorer.exe Pid: 1676 Address: 0x23f0000 Process: rundll32.exe Pid: 1760 Address: 0xb30000 Process: rundll32.exe Pid: 1760 Address: 0x3d920000 Process: Bootcamp.exe Pid: 1768 Address: 0x10c0000 Process: Bootcamp.exe Pid: 1768 Address: 0x3d920000 Process: RTHDCPL.EXE Pid: 1788 Address: 0x1bd0000 Process: RTHDCPL.EXE Pid: 1788 Address: 0x4af0000 Process: RTHDCPL.EXE Pid: 1788 Address: 0x3d920000 Process: rundll32.exe Pid: 1800 Address: 0xda0000 Process: rundll32.exe Pid: 1800 Address: 0x3d920000 Process: ctfmon.exe Pid: 1828 Address: 0xeb0000 Process: ctfmon.exe Pid: 1828 Address: 0x3d920000 Process: DumpIt.exe Pid: 368 Address: 0x130000 Process: DumpIt.exe Pid: 368 Address: 0x6fff0000 Just how would I go about seeing the injected code? Thanks for the assist. James

12 years, 6 months

1
0
0 0

Mac support vanished in latest alpha?

by David Kovar

Greetings, I was adding OS X support to my copy of Volatility per the instructions on https://code.google.com/p/volatility/wiki/MacMemoryForensics. It went well but I thought I'd pull the most recent version while I was at it. Mac support went away when I did so. setup.py is now missing: "volatility.plugins.overlays.mac", Even when I add that back, vol.py --info doesn't show the OS X profiles. Is this intentional? Is there a different version that I should be using? Thanks! -David

12 years, 6 months

3
9
0 0

Memory Collection on Windows NT

by Myerchin, Terrie A

Hi there We are looking to collect memory on an old Windows NT box. Of course, the tools we utilize are too recent to be compatible with Windows NT. Does anyone have any workaround suggestions or tools that may assist with this memory collection? Regards, Terrie

12 years, 6 months

2
1
0 0

Linux Profiles

by Kevin Marker

Group, I have a memory image file for a Red Hat 6.3 box with 2.6.32-279.el6.x86_x64 kernel. Is it ok to use the CentOS 6.3 x64 (2.6.32-279.el6.x86_x64) example profile, given it's for the same kernel, or do I need to build a new profile? Thanks for the help. Kevin Marker ACE, CCE, CISSP, EnCE

12 years, 6 months

2
1
0 0

Profile or kdbg incorrect

by David Kovar

Greetings, I'm unable to run scan tasks against a memory image and get "AttributeError: Could not list tasks, please verify your --profile with kdbgscan". I'm using 2.3_alpha updated just a moment ago. imageinfo: Suggested Profile(s) : Win7SP0x64, Win7SP1x64, Win2008R2SP0x64, Win2008R2SP1x64 AS Layer1 : AMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/usr/local/malware/XXXXXXX/XXXX-memdump.mem) PAE type : PAE DTB : 0x187000L KDBG : 0xf80002ff70a0 Number of Processors : 1 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xf80002ff8d00 KUSER_SHARED_DATA : 0xfffff78000000000L Image date and time : 2013-02-01 17:40:54 UTC+0000 Image local date and time : 2013-02-01 09:40:54 -0800 kdbgscan: Praha:Memory Image kovar$ vol.py --profile=Win7SP1x64 kdbgscan -f *.mem Volatile Systems Volatility Framework 2.3_alpha ************************************************** Instantiating KDBG using: Kernel AS Win7SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80002ff70a0 Offset (P) : 0x2ff70a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP1x64 Version64 : 0xf80002ff7068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.17944.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xf8000302d370 (0 processes) PsLoadedModuleList : 0xf8000304b670 (0 modules) KernelBase : 0xfffff80002e07000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xf80002ff8d00 (CPU 0) ************************************************** Instantiating KDBG using: Kernel AS Win7SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80002ff70a0 Offset (P) : 0x2ff70a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP0x64 Version64 : 0xf80002ff7068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.17944.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xf8000302d370 (0 processes) PsLoadedModuleList : 0xf8000304b670 (0 modules) KernelBase : 0xfffff80002e07000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xf80002ff8d00 (CPU 0) ************************************************** Instantiating KDBG using: Kernel AS Win7SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80002ff70a0 Offset (P) : 0x2ff70a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP1x64 Version64 : 0xf80002ff7068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.17944.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xf8000302d370 (0 processes) PsLoadedModuleList : 0xf8000304b670 (0 modules) KernelBase : 0xfffff80002e07000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xf80002ff8d00 (CPU 0) ************************************************** Instantiating KDBG using: Kernel AS Win7SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80002ff70a0 Offset (P) : 0x2ff70a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP0x64 Version64 : 0xf80002ff7068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.17944.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xf8000302d370 (0 processes) PsLoadedModuleList : 0xf8000304b670 (0 modules) KernelBase : 0xfffff80002e07000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xf80002ff8d00 (CPU 0) Thanks for any help you might be able to offer. -David

12 years, 7 months

3
6
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-users