6 p.m.
I have a text string that I found in memory and I would like to find out what is
using/mapped to that address. (a process, a dll, a buffer, unallocated, etc.)
How do I do that? I'm exploring the docs to see how close I can get; for example
dumping what I can with memmap, and then searching for my physical offset. (but that only
gets me processes)
Any suggestions appreciated.
Mike Lambert
dragonforen(a)hotmail.com
1:48 a.m.
Mike,
You can try the strings command:
http://code.google.com/p/volatility/wiki/CommandReference#strings
Since you know what string you're looking for, and assuming you don't
find it in process memory with vaddump or memdump, you could also
write your own plugin that does something like this (assuming x86):
CHUNKSIZE = 0x100000 # 1 MB
for addr in xrange(0x80000000, 0xFFFFFFFF, CHUNKSIZE):
data = addr_space.zread(addr, CHUNKSIZE)
# test if your strings are in data
MHL
On Fri, Feb 3, 2012 at 6:00 PM, Mike Houston <dragonforen(a)hotmail.com> wrote:
I have a text string that I found in memory and I
would like to find out
what is using/mapped to that address. (a process, a dll, a buffer,
unallocated, etc.)
How do I do that? I'm exploring the docs to see how close I can get; for
example dumping what I can with memmap, and then searching for my physical
offset. (but that only gets me processes)
Any suggestions appreciated.
Mike Lambert
dragonforen(a)hotmail.com
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
6 p.m.
Hi Mike,
I did try strings.
My string input file (120129Nbivevokoxa.txt ) looks like this
192480a0:Nbivevokoxa
My commandline was:
C:\Python27\volatility-2.0>python vol.py strings --profile=WinXPSP3x86 -s
\mem\120129\120129Nbivevokoxa.txt -f \mem\120129\120129c.w32 --output=text
--output-file=\mem\120129\120129strings.txt -S
Volatile Systems Volatility Framework 2.0
ERROR : volatility.plugins.strings: String file format invalid.
What should the contents of 120129Nbivevokoxa.txt look like?
Thanks,
Mike
Date: Sat, 4 Feb 2012 01:48:10 -0500
Subject: Re: [Vol-users] what is at that address
From: michael.hale(a)gmail.com
To: dragonforen(a)hotmail.com
CC: vol-users(a)volatilityfoundation.org
Mike,
You can try the strings command:
http://code.google.com/p/volatility/wiki/CommandReference#strings
Since you know what string you're looking for, and assuming you don't
find it in process memory with vaddump or memdump, you could also
write your own plugin that does something like this (assuming x86):
CHUNKSIZE = 0x100000 # 1 MB
for addr in xrange(0x80000000, 0xFFFFFFFF, CHUNKSIZE):
data = addr_space.zread(addr, CHUNKSIZE)
# test if your strings are in data
MHL
On Fri, Feb 3, 2012 at 6:00 PM, Mike Houston <dragonforen(a)hotmail.com> wrote:
> I have a text string that I found in memory and I would like to find out
> what is using/mapped to that address. (a process, a dll, a buffer,
> unallocated, etc.)
>
> How do I do that? I'm exploring the docs to see how close I can get; for
> example dumping what I can with memmap, and then searching for my physical
> offset. (but that only gets me processes)
>
> Any suggestions appreciated.
>
> Mike Lambert
> dragonforen(a)hotmail.com
>
>
>
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
6:46 p.m.
Hiya Mike,
On 04/02/12 23:00, Mike Lambert wrote:
My string input file (120129Nbivevokoxa.txt ) looks
like this
192480a0:Nbivevokoxa
I'm afraid the strings plugin only accepts decimal offsets, rather than
hexidecimal offsets. Please run strings using -td, or just change your
one example to "421822624:Nbivevokoxa"...
Mike
7:24 p.m.
Thanks Mike!
HaHa! I was searching a memory image with Encase. Encase gave me a decimal offset into the
memory image.
For some reason I thought I had to convert it to hex. Looks like the joke was on me!
Works great, thanks for pointing out my error!
BTW, what is "... using -td, ..."? I don't see -td mentioned in -h or the
docs online.
I'm using http://code.google.com/p/volatility/wiki/CommandReference and the -h
command, is the more docs somewhere else I need to be looking at?
Does anyone live in Houston?
Best,
Mike
Date: Sat, 4 Feb 2012 23:46:29 +0000
From: mike.auty(a)gmail.com
To: vol-users(a)volatilityfoundation.org
Subject: Re: [Vol-users] what is at that address
Hiya Mike,
On 04/02/12 23:00, Mike Lambert wrote:
My string input file (120129Nbivevokoxa.txt )
looks like this
192480a0:Nbivevokoxa
I'm afraid the strings plugin only accepts decimal offsets, rather than
hexidecimal offsets. Please run strings using -td, or just change your
one example to "421822624:Nbivevokoxa"...
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
7:30 p.m.
Hiya Mike,
On 05/02/12 00:24, Mike Lambert wrote:
Works great, thanks for pointing out my error!
Glad you got it all working. 5:)
BTW, what is "... using -td, ..."? I
don't see -td mentioned in -h or
the docs online.
Sorry, it's a command-line switch for the linux "strings" utility, which
is what is usually used for generating the input files for the
volatility strings plugin. I hope that makes sense, there's a few too
many things called "strings" flying around... 5:)
Mike
2:34 a.m.
Mike,
You could also use the pas2kas module:
http://code.google.com/p/volatility/source/browse/branches/scudette/volatil…
Michael.
On 3 February 2012 15:00, Mike Houston <dragonforen(a)hotmail.com> wrote:
I have a text string that I found in memory and I
would like to find out
what is using/mapped to that address. (a process, a dll, a buffer,
unallocated, etc.)
How do I do that? I'm exploring the docs to see how close I can get; for
example dumping what I can with memmap, and then searching for my physical
offset. (but that only gets me processes)
Any suggestions appreciated.
Mike Lambert
dragonforen(a)hotmail.com
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
6:43 p.m.
I did figure out one way to do this, and it works if the memory block is used by a
process.
I used memmap and dumped every processes to a text file. I then used notepad to search for
my physical address (and found it). The I just page-up until I see that process name.
It would be really cool if there was a switch that would change the output from:
smss.exe pid: 724
Virtual Physical Size
0x0000100000 0x00090b6000 0x000000001000
to:
Virtual Physical Size Process PID
0x0000100000 0x00090b6000 0x000000001000 smss.exe 724
Then you could put it in a spreadsheet, sort on physical address. You would then have a
great guide to reference when you were exploring the memory dump with Encase or a sector
editor (looking for interesting addresses or strings). I do this frequently.
Best to all,
Mike Lambert
From: dragonforen(a)hotmail.com
To: vol-users(a)volatilityfoundation.org
Date: Fri, 3 Feb 2012 17:00:31 -0600
Subject: [Vol-users] what is at that address
I have a text string that I found in memory and I would like to find out what is
using/mapped to that address. (a process, a dll, a buffer, unallocated, etc.)
How do I do that? I'm exploring the docs to see how close I can get; for example
dumping what I can with memmap, and then searching for my physical offset. (but that only
gets me processes)
Any suggestions appreciated.
Mike Lambert
dragonforen(a)hotmail.com
_______________________________________________ Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
7:05 p.m.
I updated our documentation to make it clear that decimal offsets are
required, and we'll give your suggestion below some thought before the
next major release of Volatility
(http://code.google.com/p/volatility/issues/detail?id=205)
Thanks!
MHL
On Sat, Feb 4, 2012 at 6:43 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
I did figure out one way to do this, and it works if
the memory block is
used by a process.
I used memmap and dumped every processes to a text file. I then used notepad
to search for my physical address (and found it). The I just page-up until I
see that process name.
It would be really cool if there was a switch that would change the output
from:
smss.exe pid: 724
Virtual Physical Size
0x0000100000 0x00090b6000 0x000000001000
to:
Virtual Physical Size
Process PID
0x0000100000 0x00090b6000 0x000000001000 smss.exe 724
Then you could put it in a spreadsheet, sort on physical address. You would
then have a great guide to reference when you were exploring the memory dump
with Encase or a sector editor (looking for interesting addresses or
strings). I do this frequently.
Best to all,
Mike Lambert
________________________________
From: dragonforen(a)hotmail.com
To: vol-users(a)volatilityfoundation.org
Date: Fri, 3 Feb 2012 17:00:31 -0600
Subject: [Vol-users] what is at that address
I have a text string that I found in memory and I would like to find out
what is using/mapped to that address. (a process, a dll, a buffer,
unallocated, etc.)
How do I do that? I'm exploring the docs to see how close I can get; for
example dumping what I can with memmap, and then searching for my physical
offset. (but that only gets me processes)
Any suggestions appreciated.
Mike Lambert
dragonforen(a)hotmail.com
_______________________________________________ Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
7:26 p.m.
Thanks Mike and to everyone for the help.
Date: Sat, 4 Feb 2012 19:05:29 -0500
Subject: Re: [Vol-users] what is at that address
From: michael.hale(a)gmail.com
To: dragonforen(a)hotmail.com
CC: vol-users(a)volatilityfoundation.org
I updated our documentation to make it clear that decimal offsets are
required, and we'll give your suggestion below some thought before the
next major release of Volatility
(http://code.google.com/p/volatility/issues/detail?id=205)
Thanks!
MHL
On Sat, Feb 4, 2012 at 6:43 PM, Mike Lambert <dragonforen(a)hotmail.com> wrote:
> I did figure out one way to do this, and it works if the memory block is
> used by a process.
>
> I used memmap and dumped every processes to a text file. I then used notepad
> to search for my physical address (and found it). The I just page-up until I
> see that process name.
>
> It would be really cool if there was a switch that would change the output
> from:
>
> smss.exe pid: 724
> Virtual Physical Size
> 0x0000100000 0x00090b6000 0x000000001000
>
> to:
>
> Virtual Physical Size
> Process PID
> 0x0000100000 0x00090b6000 0x000000001000 smss.exe 724
>
> Then you could put it in a spreadsheet, sort on physical address. You would
> then have a great guide to reference when you were exploring the memory dump
> with Encase or a sector editor (looking for interesting addresses or
> strings). I do this frequently.
>
> Best to all,
> Mike Lambert
>
> ________________________________
> From: dragonforen(a)hotmail.com
> To: vol-users(a)volatilityfoundation.org
> Date: Fri, 3 Feb 2012 17:00:31 -0600
> Subject: [Vol-users] what is at that address
>
>
> I have a text string that I found in memory and I would like to find out
> what is using/mapped to that address. (a process, a dll, a buffer,
> unallocated, etc.)
>
> How do I do that? I'm exploring the docs to see how close I can get; for
> example dumping what I can with memmap, and then searching for my physical
> offset. (but that only gets me processes)
>
> Any suggestions appreciated.
>
> Mike Lambert
> dragonforen(a)hotmail.com
>
>
>
>
> _______________________________________________ Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
4666
days inactive
4668
days old
vol-users@lists.volatilityfoundation.org
9 comments
5 participants
participants (5)
-
Michael Cohen -
Michael Hale Ligh -
Mike Auty -
Mike Houston -
Mike Lambert