One of you asked about how to use the procdump feature of Volatility to extract a process from the memory image. So first of all: how do you know which process you would like to dump? You can get a list of all running processes in the image by using the pslist command:
$ ./volatility pslist -f ../memimages/xp-laptop-2005-07-04-1430.img
Name Pid PPid Thds Hnds Time
[lots of output left out]
VPTray.exe 2496 2392 2 111 Mon Jul 04 18:18:06 2005
atiptaxx.exe 2524 2392 1 51 Mon Jul 04 18:18:06 2005
jusched.exe 2548 2392 1 22 Mon Jul 04 18:18:07 2005
EM_EXEC.EXE 2588 2540 2 80 Mon Jul 04 18:18:09 2005
WZQKPICK.EXE 2692 2392 1 17 Mon Jul 04 18:18:15 2005
wuauclt.exe 3128 800 3 157 Mon Jul 04 18:19:11 2005
taskmgr.exe 3192 2392 3 65 Mon Jul 04 18:19:33 2005
cmd.exe 3256 2392 1 29 Mon Jul 04 18:20:58 2005
firefox.exe 3276 2392 7 189 Mon Jul 04 18:21:11 2005
PluckSvr.exe 3352 680 6 206 Mon Jul 04 18:21:42 2005
PluckTray.exe 3612 3352 3 102 Mon Jul 04 18:24:00 2005
PluckUpdater.ex 368 3352 0 -1 Mon Jul 04 18:24:30 2005
dd.exe 3300 3256 1 22 Mon Jul 04 18:30:32 2005
So let's say that we want to dump the firefox process, we can do that. First of all you should note the Process ID (pid) of the firefox process to make your life much simpler. Firefox's pid is 3276 which we can see above.
Next, how do you know which command you enter to accomplish this? Well, we know that if we just run volatility with no options, we will get a list of the commands that we can use:
./volatility
Volatile Systems Volatility Framework v1.3
Copyright (C) 2007,2008 Volatile Systems
Copyright (C) 2007 Komoku, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
usage: volatility cmd [cmd_opts]
Run command cmd with options cmd_opts
For help on a specific command, run 'volatility cmd --help'
Supported Internel Commands:
connections Print list of open connections
connscan Scan for connection objects
connscan2 Scan for connection objects (New)
datetime Get date/time information for image
dlllist Print list of loaded dlls for each process
dmp2raw Convert a crash dump to a raw dump
dmpchk Dump crash dump information
files Print list of open files for each process
hibinfo Convert hibernation file to linear raw image
ident Identify image properties
memdmp Dump the addressable memory for a process
memmap Print the memory map
modscan Scan for modules
modscan2 Scan for module objects (New)
modules Print list of loaded modules
procdump Dump a process to an executable sample
pslist Print list of running processes
psscan Scan for EPROCESS objects
psscan2 Scan for process objects (New)
raw2dmp Convert a raw dump to a crash dump
regobjkeys Print list of open regkeys for each process
sockets Print list of open sockets
sockscan Scan for socket objects
sockscan2 Scan for socket objects (New)
strings Match physical offsets to virtual addresses (may take a while, VERY verbose)
thrdscan Scan for ETHREAD objects
thrdscan2 Scan for thread objects (New)
vaddump Dump the Vad sections to files
vadinfo Dump the VAD info
vadwalk Walk the vad tree
Supported Plugin Commands:
getsids Print the SIDs owning each process
memmap_ex_2 Print the memory map
pslist_ex_1 Print list running processes
pslist_ex_3 Print list running processes
ssdt Display SSDT entries
thread_queues Print message queues for each thread
usrdmp_ex_2 Dump the address space for a process
volshell Shell in the memory image
Example: volatility pslist -f /path/to/my/file
Now if you run the procdump command without any other options it will dump all processes in the memory dump, which is not what we want. Therefore we should figure out how to get a usage statement for this command. If we issue Volatility with the command and the option -h then we get the following:
./volatility procdump -h
Usage: procdump [options] (see --help)
Options:
-h, --help show this help message and exit
-f FILENAME, --file=FILENAME
(required) XP SP2 Image file
-b BASE, --base=BASE (optional, otherwise best guess is made) Physical
offset (in hex) of directory table base
-t TYPE, --type=TYPE (optional, default="auto") Identify the image type
(pae, nopae, auto)
-o OFFSET, --offset=OFFSET
EPROCESS Offset (in hex) in physcial address space
-p PID, --pid=PID Dump the process with this Pid
-m MODE, --mode=MODE strategy to use when saving executable. Use "disk" to
save using disk-based section sizes, "mem" for memory-
based sections. (default: "mem")
-u, --unsafe do not perform sanity checks on sections when dumping
Now to dump the firefox process we can type the following:
./volatility procdump -p 3276 -f ../memimages/xp-laptop-2005-07-04-1430.img
You should end up with a file called executable.3276.exe
No comments:
Post a Comment