forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem --profile=MacMountainLion_10_8_2_AMDx64 mac_ifconfig
Volatility Foundation Volatility Framework 2.4
Interface Address
---------- -------
lo0 fe80:1::1
lo0 127.0.0.1
lo0 ::1
gif0
stf0
en0 00:0c:29:ea:9a:27
en0 fe80:4::20c:29ff:feea:9a27
en0 172.16.253.140
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem --profile=MacMountainLion_10_8_2_AMDx64 mac_version
Volatility Foundation Volatility Framework 2.4
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem --profile=MacMountainLion_10_8_2_AMDx64 mac_netstat
Volatility Foundation Volatility Framework 2.4
Proto Local IP Local Port Remote IP Remote Port State Process
------ -------------------- ---------- -------------------- ----------- -------------------- ------------------------
UNIX -
UNIX /var/tmp/launchd/sock
UNIX -
UNIX /var/run/com.apple.ActivityMonitor.socket
UNIX /var/run/mDNSResponder
UNIX /var/rpc/ncacn_np/lsarpc
UNIX /var/rpc/ncalrpc/lsarpc
UNIX /var/rpc/ncacn_np/mdssvc
UNIX /var/rpc/ncalrpc/NETLOGON
UNIX /var/rpc/ncacn_np/srvsvc
UNIX /var/rpc/ncalrpc/srvsvc
UNIX /var/rpc/ncacn_np/wkssvc
UNIX /var/rpc/ncalrpc/wkssvc
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in <module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File "/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py", line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py", line 127, in execute
func(outfd, data)
File "/home/forensics/programs/volatility-2.4/volatility/plugins/mac/netstat.py", line 58, in render_text
self.table_row(outfd, proto, lip, lport, rip, rport, state, "{}/{}".format(proc.p_comm, proc.p_pid))
ValueError: zero length field name in format
+++++++++++++++++++++++++++++++++++++++++
forensics@saturn:~/workspace/iworm/memory$ vol -f iworm_run1.vmem --profile=MacMountainLion_10_8_2_AMDx64 mac_arp
Volatility Foundation Volatility Framework 2.4
Source IP Dest. IP Name Sent Recv Time Exp. Delta
------------------------ ------------------------ ---------- ------------------ ------------------ ------------------------------ ---------- -----
Traceback (most recent call last):
File "/home/forensics/programs/volatility-2.4/vol.py", line 192, in <module>
main()
File "/home/forensics/programs/volatility-2.4/vol.py", line 183, in main
command.execute()
File "/home/forensics/programs/volatility-2.4/volatility/plugins/mac/common.py", line 46, in execute
commands.Command.execute(self, *args, **kwargs)
File "/home/forensics/programs/volatility-2.4/volatility/commands.py", line 127, in execute
func(outfd, data)
File "/home/forensics/programs/volatility-2.4/volatility/plugins/mac/route.py", line 104, in render_text
File "/home/forensics/programs/volatility-2.4/volatility/obj.py", line 537, in __getattr__
return getattr(result, attr)
File "/home/forensics/programs/volatility-2.4/volatility/plugins/overlays/mac/mac.py", line 562, in name
return "{}{}".format(self.rt_ifp.if_name.dereference(), self.rt_ifp.if_unit)
ValueError: zero length field name in format
++++++++++++++++++++++++++++++
Any thoughts or ideas are very appreciated!
--
Andre' M. DiMino
DeepEnd Research
http://deependresearch.orghttp://sempersecurus.org"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)