RAM analysis - Revision history

PhilippeTeuwen: /* RAM dump with VirtualBox: via ELF64 coredump */

2013-10-14T15:29:53Z

RAM dump with VirtualBox: via ELF64 coredump

← Older revision		Revision as of 15:29, 14 October 2013
Line 31:		Line 31:
	1 load1 40000000 0000000000000000 0000000000000000 00000720 2**0		1 load1 40000000 0000000000000000 0000000000000000 00000720 2**0

	<br>Let's extract the RAM, ~~using dd command to copy the dump and get~~ rid of the first bytes.		<br>Let's extract the RAM, getting rid of the first bytes.
			size=0x40000000;off=0x720;head -c $(($size+$off)) test.elf\|tail -c +$(($off+1)) > test.raw
	$ dd if=test.elf of=test.raw bs=1 skip=$((0x720)) count=$((0x40000000))
	Trying to optimize blocksize: 0x720 = 32 * 57, so
	$ dd if=test.elf of=test.raw bs=$((0x20)) skip=$((0x728/0x20)) count=$((0x40000000/0x20))
	Now using volatility on the obtained file:		Now using volatility on the obtained file:
	$ ./vol.py -f test.raw --profile=Win7SP1x86 pslist		$ ./vol.py -f test.raw --profile=Win7SP1x86 pslist

PhilippeTeuwen: /* RAM dump with VirtualBox: via ELF64 coredump */

2013-10-14T15:13:25Z

RAM dump with VirtualBox: via ELF64 coredump

← Older revision		Revision as of 15:13, 14 October 2013
Line 31:		Line 31:
	1 load1 40000000 0000000000000000 0000000000000000 00000720 2**0		1 load1 40000000 0000000000000000 0000000000000000 00000720 2**0

	<br>Let's extract the RAM. ~~Computations~~ ~~deserve~~ ~~some~~ ~~automation~~ ~~but~~ ~~doing~~ it by ~~hand~~ ~~(3257~~ = ~~0x720,~~ ~~3233554432~~ ~~= 0x40000000):~~		<br>Let's extract the RAM, using dd command to copy the dump and get rid of the first bytes.
	$ dd if=test.elf of=test.raw bs=32 skip=57 count=~~33554432~~		$ dd if=test.elf of=test.raw bs=1 skip=$((0x720)) count=$((0x40000000))
			Trying to optimize blocksize: 0x720 = 32 * 57, so
⚫	~~<br>~~Now using volatility on the obtained file:
			$ dd if=test.elf of=test.raw bs=$((0x20)) skip=$((0x728/0x20)) count=$((0x40000000/0x20))
		⚫	Now using volatility on the obtained file:
	$ ./vol.py -f test.raw --profile=Win7SP1x86 pslist		$ ./vol.py -f test.raw --profile=Win7SP1x86 pslist
	Volatile Systems Volatility Framework 2.0		Volatile Systems Volatility Framework 2.0
Line 45:		Line 47:
	0x84d9c568 winlogon.exe 392 332 5 111 2012-02-07 16:06:42		0x84d9c568 winlogon.exe 392 332 5 111 2012-02-07 16:06:42
	etc		etc

	==Volatility with VirtualBox: via ELF64 coredump==		==Volatility with VirtualBox: via ELF64 coredump==
	We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.		We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.

PhilippeTeuwen: /* Volatility with VirtualBox: via ELF64 coredump */

2012-10-11T17:14:22Z

Volatility with VirtualBox: via ELF64 coredump

← Older revision		Revision as of 17:14, 11 October 2012
Line 144:		Line 144:
	Currently [https://code.google.com/p/volatility/issues/detail?id=212 an issue] was opened to discuss possible integration of this plugin into the core source.		Currently [https://code.google.com/p/volatility/issues/detail?id=212 an issue] was opened to discuss possible integration of this plugin into the core source.
	<br>Meanwhile the plugin is mentioned [https://code.google.com/p/volatility/wiki/DocFiles20#Development_and_Plugins in the Volatility wiki].		<br>Meanwhile the plugin is mentioned [https://code.google.com/p/volatility/wiki/DocFiles20#Development_and_Plugins in the Volatility wiki].
			<br>'''Update:''' this has been integrated in branch 2.3-devel in [https://code.google.com/p/volatility/source/detail?r=2667 r2667] to r2670

	==RAM dump with VirtualBox: via pgmphystofile==		==RAM dump with VirtualBox: via pgmphystofile==

PhilippeTeuwen: /* Volatility with VirtualBox: via ELF64 coredump */

2012-02-16T15:56:12Z

Volatility with VirtualBox: via ELF64 coredump

← Older revision		Revision as of 15:56, 16 February 2012
Line 142:		Line 142:
	<br>Warning: --plugins option was recognised only if placed before -f option		<br>Warning: --plugins option was recognised only if placed before -f option
	./vol.py --plugins=/path/to/vboxelf.zip -f test.elf --profile=Win7SP1x86 pslist		./vol.py --plugins=/path/to/vboxelf.zip -f test.elf --profile=Win7SP1x86 pslist
			Currently [https://code.google.com/p/volatility/issues/detail?id=212 an issue] was opened to discuss possible integration of this plugin into the core source.
			<br>Meanwhile the plugin is mentioned [https://code.google.com/p/volatility/wiki/DocFiles20#Development_and_Plugins in the Volatility wiki].

	==RAM dump with VirtualBox: via pgmphystofile==		==RAM dump with VirtualBox: via pgmphystofile==
	See https://www.virtualbox.org/ticket/10222		See https://www.virtualbox.org/ticket/10222

PhilippeTeuwen: /* RAM dump with VirtualBox: via pgmphystofile */

2012-02-10T19:39:30Z

RAM dump with VirtualBox: via pgmphystofile

← Older revision		Revision as of 19:39, 10 February 2012
Line 148:		Line 148:
	* Then use <code>.pgmphystofile filename</code> to save the physical memory to the given file.		* Then use <code>.pgmphystofile filename</code> to save the physical memory to the given file.
	This file is directly the RAM image and can be read as such by Volatility.		This file is directly the RAM image and can be read as such by Volatility.

			So why using the first method if this method provides directly a memory dump?
			<br>It depends your needs, it is currently not possible to automate this second method from a command line or API.

PhilippeTeuwen at 19:29, 10 February 2012

2012-02-10T19:29:31Z

← Older revision		Revision as of 19:29, 10 February 2012
Line 6:		Line 6:
	* [http://www.lostpassword.com/kit-forensic.htm Passware], a commercial tool mostly aiming at recovering passwords, including from memory dumps		* [http://www.lostpassword.com/kit-forensic.htm Passware], a commercial tool mostly aiming at recovering passwords, including from memory dumps

	==RAM dump with VirtualBox==		==RAM dump with VirtualBox: via ELF64 coredump==
	VMWare snapshots contain a .vmem which is basically a RAM dump, but for VirtualBox, it's not that easy...		VMWare snapshots contain a .vmem which is basically a RAM dump, but for VirtualBox, it's not that easy...
	<br>Snapshot .sav files contain all machine state including memory but in a hardly exploitable format (even if VirtualBox is open-source...) and the [http://sempersecurus.blogspot.com/2011/04/using-volatility-to-study-cve-2011-6011.html few] [https://forums.virtualbox.org/viewtopic.php?f=1&t=44219 people] having looked in that direction didn't succeed.		<br>Snapshot .sav files contain all machine state including memory but in a hardly exploitable format (even if VirtualBox is open-source...) and the [http://sempersecurus.blogspot.com/2011/04/using-volatility-to-study-cve-2011-6011.html few] [https://forums.virtualbox.org/viewtopic.php?f=1&t=44219 people] having looked in that direction didn't succeed.
Line 45:		Line 45:
	0x84d9c568 winlogon.exe 392 332 5 111 2012-02-07 16:06:42		0x84d9c568 winlogon.exe 392 332 5 111 2012-02-07 16:06:42
	etc		etc
	==Volatility with VirtualBox==		==Volatility with VirtualBox: via ELF64 coredump==
	We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.		We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.
	<br>Thanks to the support of Mike Auty, I managed to write a plugin for Volatility.		<br>Thanks to the support of Mike Auty, I managed to write a plugin for Volatility.
Line 142:		Line 142:
	<br>Warning: --plugins option was recognised only if placed before -f option		<br>Warning: --plugins option was recognised only if placed before -f option
	./vol.py --plugins=/path/to/vboxelf.zip -f test.elf --profile=Win7SP1x86 pslist		./vol.py --plugins=/path/to/vboxelf.zip -f test.elf --profile=Win7SP1x86 pslist
			==RAM dump with VirtualBox: via pgmphystofile==
			See https://www.virtualbox.org/ticket/10222
			* Start the VM with "VirtualBox --dbg --startvm <VM name>".
			* Click on the "Debug" menu -> "Command line...".
			* Then use <code>.pgmphystofile filename</code> to save the physical memory to the given file.
			This file is directly the RAM image and can be read as such by Volatility.

PhilippeTeuwen: /* Volatility with VirtualBox */

2012-02-09T23:50:04Z

Volatility with VirtualBox

← Older revision		Revision as of 23:50, 9 February 2012
Line 47:		Line 47:
	==Volatility with VirtualBox==		==Volatility with VirtualBox==
	We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.		We just saw how to extract a RAM image but it would be nice if Volatility was able to read directly the VirtualBox core dump.
	<br>Thanks to the support of Mike Auty I managed to write a plugin for Volatility.		<br>Thanks to the support of Mike Auty, I managed to write a plugin for Volatility.
	<br>You can download it [{{#file: vboxelf.py}} as vboxelf.py]		<br>You can download it [{{#file: vboxelf.py}} as vboxelf.py]
	<source lang=python>		<source lang=python>

PhilippeTeuwen: /* Volatility with VirtualBox */

2012-02-09T22:59:43Z

Volatility with VirtualBox

← Older revision		Revision as of 22:59, 9 February 2012
Line 138:		Line 138:
	return self.base.is_valid_address(addr + self.moffset)		return self.base.is_valid_address(addr + self.moffset)
	</source>		</source>
	To be placed in your Volatility installation under plugins/addrspaces		To be placed in your Volatility installation under plugins/addrspaces or to be used via the --plugins option:
			<br>Place vboxelf.py in a zip file or in a directory and pass it.
			<br>Warning: --plugins option was recognised only if placed before -f option
			./vol.py --plugins=/path/to/vboxelf.zip -f test.elf --profile=Win7SP1x86 pslist

PhilippeTeuwen: /* Volatility with VirtualBox */

2012-02-09T17:01:24Z

Volatility with VirtualBox

← Older revision		Revision as of 17:01, 9 February 2012
Line 105:		Line 105:
	self.as_assert((descsz == 24), 'Abnormal VBCORE size')		self.as_assert((descsz == 24), 'Abnormal VBCORE size')
	# parsing DBGFCOREDESCRIPTOR:		# parsing DBGFCOREDESCRIPTOR:
	(magic, fmtvers, selfsize, vbvers, vbrev, ncpus) = struct.unpack('<IIIIII', base.read(offset+12+((((namesz-1)>>3)+1)<<3), ~~descsz~~))		(magic, fmtvers, selfsize, vbvers, vbrev, ncpus) = struct.unpack('<IIIIII', base.read(offset+12+((((namesz-1)>>3)+1)<<3), 24))
	self.as_assert((magic == 0xc01ac0de), 'Could not find VBox core magic signature')		self.as_assert((magic == 0xc01ac0de), 'Could not find VBox core magic signature')
	self.as_assert((fmtvers == 0x00010000), 'Unknown VBox core format version')		self.as_assert((fmtvers == 0x00010000), 'Unknown VBox core format version')

PhilippeTeuwen: /* Volatility with VirtualBox */

2012-02-09T17:00:39Z

Volatility with VirtualBox

← Older revision		Revision as of 17:00, 9 February 2012
Line 105:		Line 105:
	self.as_assert((descsz == 24), 'Abnormal VBCORE size')		self.as_assert((descsz == 24), 'Abnormal VBCORE size')
	# parsing DBGFCOREDESCRIPTOR:		# parsing DBGFCOREDESCRIPTOR:
	(magic, fmtvers, selfsize, vbvers, vbrev, ncpus) = struct.unpack('<IIIIII', base.read(offset+12+(((namesz>>3)+1)<<3), descsz))		(magic, fmtvers, selfsize, vbvers, vbrev, ncpus) = struct.unpack('<IIIIII', base.read(offset+12+((((namesz-1)>>3)+1)<<3), descsz))
	self.as_assert((magic == 0xc01ac0de), 'Could not find VBox core magic signature')		self.as_assert((magic == 0xc01ac0de), 'Could not find VBox core magic signature')
	self.as_assert((fmtvers == 0x00010000), 'Unknown VBox core format version')		self.as_assert((fmtvers == 0x00010000), 'Unknown VBox core format version')