- Vol-users - volatilityfoundation.org

by Mike Lambert

I have read the command reference for the strings plugin and do not see an option to specify the string to look for in anything other than ascii. Could strings be expanded to include hex values, perhaps in the form of \x55\x5e\xe2\xfd\x83\xc4 or something like that? Thanks, Mike Lambert

13 years, 5 months

5
8
0 1

FW: [Vol-users] Using Windows XP VMs for testing and windows activation

by Mike Lambert

Thanks Howard, it works like a champ! Mike From: Howard.Patterson(a)tn.gov To: dragonforen(a)hotmail.com Subject: RE: [Vol-users] Using Windows XP VMs for testing and windows activation Date: Thu, 12 Apr 2012 23:27:12 +0000 The easiest way I've found, and one I think will work in your situation, is to boot into Safe Mode with the XP system. Then choose "Start, Run" and enter the following: rundll32.exe syssetup,SetupOobeBnk Those are both the letter "Ohs" in there and it is case sensitive. If it works you won't see any sign of it until you reboot. If you type it incorrectly an error message will come back. This basically resets how long you have to activate (I believe 30 days). -Howard From: vol-users-bounces(a)volatilityfoundation.org [mailto:vol-users-bounces@volatilesystems.com] On Behalf Of Mike Lambert Sent: Thursday, April 12, 2012 6:06 PM To: Volatility List Subject: [Vol-users] Using Windows XP VMs for testing and windows activation I have not used VMs in the past to do malware testing because of the windows activation problems I run into. Clone, you have to activate; copy, you have to activate; move, you have to activate. I'm surprised that it still activates! I would like to talk to someone who knows the best way to deal with this. (or not) I'd like to have a clone that is infected that I can go back to later. (I do that now with hard disk images - I can put back a disk image to disk and plug it into the computer and bring it right back up.) I can continue to use my test system, which I do not have any problem with. I blow a copy of a clean system to disk and then go on testing without any activation problems. Let me know if you have a solution. Thanks, Mike

13 years, 5 months

1
0
0 0

Using Windows XP VMs for testing and windows activation

by Mike Lambert

I have not used VMs in the past to do malware testing because of the windows activation problems I run into. Clone, you have to activate; copy, you have to activate; move, you have to activate. I'm surprised that it still activates! I would like to talk to someone who knows the best way to deal with this. (or not) I'd like to have a clone that is infected that I can go back to later. (I do that now with hard disk images - I can put back a disk image to disk and plug it into the computer and bring it right back up.) I can continue to use my test system, which I do not have any problem with. I blow a copy of a clean system to disk and then go on testing without any activation problems. Let me know if you have a solution. Thanks, Mike

13 years, 5 months

2
2
0 0

Server 2008

by Dustin Mooney

All, Has anyone successfully analyzed memory from a windows 2008 server memory dump? This is my third time attempting to do so, and have yet to have any success with volatility. I took the memory dump so I know the profile, however, volatility reports it as a Windows 7 machine. Any advice on how to approach this persistent problem?

13 years, 5 months

3
3
0 0

Analyzing diasassembly with little information

by fd ksdf

Hello! malfind found some suspicious regions and printed the disassembly so I went into volshell to get more information, but what exactly can someone do with this disassembly? As far as I know, there are no symbols, no way to view what is in the registers or these memory addresses, and when I try to disassemble the few CALLs I can, I get a "Memory unreadable" error. >>> dis(0x08070000,512) 0x8070000 55 PUSH EBP 0x8070001 8bec MOV EBP, ESP 0x8070003 83c4ec ADD ESP, -0x14 0x8070006 56 PUSH ESI 0x8070007 57 PUSH EDI 0x8070008 8b4508 MOV EAX, [EBP+0x8] 0x807000b 8bf0 MOV ESI, EAX 0x807000d 8d7dec LEA EDI, [EBP-0x14] 0x8070010 a5 MOVSD 0x8070011 a5 MOVSD 0x8070012 a5 MOVSD 0x8070013 a5 MOVSD 0x8070014 a5 MOVSD 0x8070015 ff75f8 PUSH DWORD [EBP-0x8] 0x8070018 ff55f4 CALL DWORD [EBP-0xc] 0x807001b ff75fc PUSH DWORD [EBP-0x4] 0x807001e 50 PUSH EAX 0x807001f ff55f0 CALL DWORD [EBP-0x10] 0x8070022 50 PUSH EAX 0x8070023 ff55ec CALL DWORD [EBP-0x14] 0x8070026 5f POP EDI 0x8070027 5e POP ESI 0x8070028 8be5 MOV ESP, EBP 0x807002a 5d POP EBP 0x807002b c20400 RET 0x4 0x807002e 8bc0 MOV EAX, EAX 0x8070030 53 PUSH EBX 0x8070031 56 PUSH ESI 0x8070032 57 PUSH EDI 0x8070033 55 PUSH EBP 0x8070034 83c4e8 ADD ESP, -0x18 0x8070037 8be9 MOV EBP, ECX 0x8070039 8bfa MOV EDI, EDX 0x807003b 8bd8 MOV EBX, EAX 0x807003d 33f6 XOR ESI, ESI 0x807003f 6800334000 PUSH DWORD 0x403300 0x8070044 6814334000 PUSH DWORD 0x403314 0x8070049 e85efaffff CALL 0x806faac 0x807004e 50 PUSH EAX 0x807004f e860faffff CALL 0x806fab4 0x8070054 8944240c MOV [ESP+0xc], EAX 0x8070058 6820334000 PUSH DWORD 0x403320 0x807005d 6814334000 PUSH DWORD 0x403314 0x8070062 e845faffff CALL 0x806faac 0x8070067 50 PUSH EAX 0x8070068 e847faffff CALL 0x806fab4 0x807006d 89442408 MOV [ESP+0x8], EAX 0x8070071 6830334000 PUSH DWORD 0x403330 0x8070076 6814334000 PUSH DWORD 0x403314 0x807007b e82cfaffff CALL 0x806faac 0x8070080 50 PUSH EAX 0x8070081 e82efaffff CALL 0x806fab4 0x8070086 89442404 MOV [ESP+0x4], EAX 0x807008a 8bd5 MOV EDX, EBP 0x807008c 8bc3 MOV EAX, EBX 0x807008e 0000 ADD [EAX], AL 0x8070090 0000 ADD [EAX], AL 0x8070092 0000 ADD [EAX], AL 0x8070094 0000 ADD [EAX], AL 0x8070096 0000 ADD [EAX], AL 0x8070098 0000 ADD [EAX], AL 0x807009a 0000 ADD [EAX], AL 0x807009c 0000 ADD [EAX], AL 0x807009e 0000 ADD [EAX], AL [snip] >>> dis(0x806faac) >>> db(0x806faac) Memory unreadable at 0806faac >>>

13 years, 5 months

3
3
0 0

Volatility 1.3 cryptoscan plugin output

by Mike Lambert

Could someone send me a sample of what the output for the cryptoscan plugin output should be? Thanks, Mike

13 years, 5 months

1
0
0 0

"RAM is Key, Extracting Disk Encryption Keys From Volatile Memory" paper

by Mike Lambert

Does anyone have a copy of Brian Kaplan's paper, "RAM is Key, Extracting Disk Encryption Keys From Volatile Memory" that they could email me at dragonforen(a)hotmail.com If so, thank you! Mike

13 years, 5 months

2
1
0 0

decrypting the zeus config file

by malware monna

Hi, I'm using zeusscan2 module against a zeus infected memory dump, i'm able to get the rc4 keys and xor keys as mentioned in this link " http://mnin.blogspot.in/2011/09/abstract-memory-analysis-zeus.html".......i have also downloaded the zeus config file, that this sample tried to download, knowing this information, is it possible to decrypt the config file, if yes, how can i decrypt the config file or what are the steps to decrypt the config file?....and i think the zeuscan plugin is really awesome (Thanks Michael for writing such a great plugin, its really useful?).. Thanks,

13 years, 5 months

1
0
0 0

Hiberfil information

by Dewhirst, Rob

Does this mean volatility can't identify the hiberfil? $ python ~/Volatility/vol.py hibinfo -f hiberfile.sys Volatile Systems Volatility Framework 2.1_alpha No suitable address space mapping found Tried to open image as: WindowsHiberFileSpace32: No base Address Space EWFAddressSpace: No base address space provided WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space JKIA32PagedMemory: No base Address Space JKIA32PagedMemoryPae: No base Address Space IA32PagedMemoryPae: Module disabled IA32PagedMemory: Module disabled WindowsHiberFileSpace32: No xpress signature found EWFAddressSpace: EWF signature not present WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Incompatible profile WinXPSP2x86 selected JKIA32PagedMemory: No valid DTB found JKIA32PagedMemoryPae: No valid DTB found IA32PagedMemoryPae: Module disabled IA32PagedMemory: Module disabled FileAddressSpace: Must be first Address Space

13 years, 5 months

3
8
0 0

Failed to import errors on last few revisions

by Tom Yarrish

Hello, Over the last week or so, when I've done an svn update on the 2.1_alpha code, I've been receiving the following errors: Volatile Systems Volatility Framework 2.1_alpha *** Failed to import volatility.plugins.overlays.windows.win2k3_sp2_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.zeusscan1 (AttributeError: 'module' object has no attribute 'ImpScan') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.zeusscan2 (AttributeError: 'module' object has no attribute 'ApiHooks') *** Failed to import volatility.plugins.overlays.windows.vista_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp1_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp2_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.xp_sp3_x86 (AttributeError: 'module' object has no attribute 'nt_types') *** Failed to import volatility.plugins.evtlogs (AttributeError: 'module' object has no attribute 'LdrModules') *** Failed to import volatility.plugins.overlays.windows.vista_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp1_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win2k3_sp2_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp0_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.vista_sp2_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.xp_sp2_x86 (AttributeError: 'module' object has no attribute 'nt_types') *** Failed to import volatility.plugins.timeliner (AttributeError: 'module' object has no attribute 'LdrModules') *** Failed to import volatility.plugins.overlays.windows.vista_sp0_x86 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') *** Failed to import volatility.plugins.overlays.windows.win7_sp0_x64 (AttributeError: 'module' object has no attribute 'AbstractWindowsX86') (This is with revision 1558) This is just from doing an imageinfo. I was thinking since it includes plugins that some plugins need to be updated for 2.1, but I didn't want to make the assumption. It does finish the KDBG search and give me the correct profile, so it's parsing the dump. Just wasn't sure about the errors. Thanks, Tom

13 years, 6 months

3
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Vol-users