volatility—基本用法

Keyword: forensic 取证

官网: https://www.volatilityfoundation.org/
github地址: https://github.com/volatilityfoundation/volatility
wiki: https://github.com/volatilityfoundation/volatility/wiki

大部分使用相关操作都可以这样看：

volatility --help
volatility --info

查看基本信息，根据查到的信息确定profile的值
```
volatility -f BOOM-6452e9b9.vmem imageinfo
```
这个有可能找不到正确的系统版本，可以参考这个链接对比一下
https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles
指定profile，使用具体的命令
iehistory 是看浏览器的进程，pslist是ps命令(也可以用psscan)
```
volatility -f BOOM-6452e9b9.vmem --profile=Win7SP1x64 iehistory
```

查找并dump相应进程的可执行程序

root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 pslist | grep notepad
Volatility Foundation Volatility Framework 2.5
0x8398dad8 notepad.exe            3524   1636      2       61      1      0 2019-09-16 13:53:51 UTC+0000
root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 procdump -p 3524 -D ./
Volatility Foundation Volatility Framework 2.5
Process(V) ImageBase  Name                 Result
---------- ---------- -------------------- ------
0x8398dad8 0x00be0000 notepad.exe          OK: executable.3524.exe

查找并dump进程内存

root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 pslist | grep notepad
Volatility Foundation Volatility Framework 2.5
0x8398dad8 notepad.exe            3524   1636      2       61      1      0 2019-09-16 13:53:51 UTC+0000
root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 memdump -p 3524 -D ./
Volatility Foundation Volatility Framework 2.5
************************************************************************
Writing notepad.exe [  3524] to 3524.dmp

查找并dump文件

root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 filescan | grep key
Volatility Foundation Volatility Framework 2.5
0x000000001e10a868      1      1 ------ \Device\NamedPipe\keysvc
0x000000001e10a920      2      1 ------ \Device\NamedPipe\keysvc
0x000000001e10aa90      1      1 ------ \Device\NamedPipe\keysvc
0x000000001efb9370      1      0 R--rw- \Device\HarddiskVolume2\Users\lethal\Desktop\key
root@kali:~/Desktop# volatility -f mem.raw --profile=Win7SP1x86_BBA98F40 dumpfiles -Q 0x000000001efb9370 -D ./
Volatility Foundation Volatility Framework 2.5
DataSectionObject 0x1efb9370   None   \Device\HarddiskVolume2\Users\lethal\Desktop\key

部分感觉有用的插件命令

clipboard        Extract the contents of the windows clipboard
cmdline         Display process command-line arguments
cmdscan         Extract command history by scanning for _COMMAND_HISTORY
consoles        Extract command history by scanning for _CONSOLE_INFORMATION
deskscan        Poolscaner for tagDESKTOP (desktops)
dumpcerts       Dump RSA private and public SSL keys
dumpfiles       Extract memory mapped and cached files
dumpregistry    Dumps registry files out to disk
editbox         Displays information about Edit controls. (Listbox experimental.)
filescan        Pool scanner for file objects
lsadump         Dump (decrypted) LSA secrets from the registry  # 已登录用户密码明文
hashdump        Dumps passwords hashes (LM/NTLM) from memory  # 已登录用户密码hash
imageinfo       Identify information for the image
malfind         Find hidden and injected code
memdump         Dump the addressable memory for a process
raw2dmp         Converts a physical memory sample to a windbg crash dump
mftparser       Scans for and parses potential MFT entries
notepad         List currently displayed notepad text
procdump        Dump a process to an executable file sample
pslist          Print all running processes by following the EPROCESS lists
psscan          Pool scanner for process objects
pstree          Print process list as a tree
psxview         Find hidden processes with various process listings
timeliner       Creates a timeline from various artifacts in memory
truecryptmaster Recover TrueCrypt 7.1a Master Keys
truecryptpassphrase TrueCrypt Cached Passphrase Finder
truecryptsummary    TrueCrypt Summary
windows         Print Desktop Windows (verbose details)
wintree         Print Z-Order Desktop Windows Tree

注："```r"只是为了让高亮更好看一些

2019/10/22

volatility 基本用法相关推荐

android内存取证实现,[内存取证]Volatility基本用法
volatility -f memory imageinfo #查看系统版本 Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x6 ...
学习笔记-Volatility
Volatility 文章作者 r0fus0d & Lorna Dane 免责声明本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关. 简介 ...
波动率因子（Volatility factor）——投资组合分析（EAP.portfolio_analysis）
实证资产定价(Empirical asset pricing)已经发布于Github和Pypi. 包的具体用法(Documentation)博主将会陆续在CSDN中详细介绍,也可以通过Pypi直接查看 ...
关于我在windows使用volatility取证这档事
官网下载地址:https://www.volatilityfoundation.org/releases volatility3的官方文档:https://volatility3.readthedoc ...
c语言中external，static关键字用法
static用法: 在C中,static主要定义全局静态变量.定义局部静态变量.定义静态函数. 1.定义全局静态变量:在全局变量前面加上关键字static,该全局变量变成了全局静态变量.全局静态变量有 ...
Pandas_transform的用法
先来看一个实例问题. 如下销售数据中展现了三笔订单,每笔订单买了多种商品,求每种商品销售额占该笔订单总金额的比例.例如第一条数据的最终结果为:235.83 / (235.83+232.32+107.9 ...
Python中yield和yield from的用法
yield 后面接的是 future 对象调用方委托生成器 yield from 直接给出循环后的结果 yield from 委托者和子生成器直接通信 yield from 直接处理stopIte ...
pytorch学习中 torch.squeeze() 和torch.unsqueeze()的用法
squeeze的用法主要就是对数据的维度进行压缩或者解压. 先看torch.squeeze() 这个函数主要对数据的维度进行压缩,去掉维数为1的的维度,比如是一行或者一列这种,一个一行三列(1,3)的 ...
python yield 和 yield from用法总结
#例1. 简单输出斐波那契數列前 N 个数 #缺点:该函数可复用性较差,因为 fab 函数返回 None,其他函数无法获得该函数生成的数列 #要提高 fab 函数的可复用性,最好不要直接打印出数列,而 ...
tf.nn.embedding_lookup()的用法
函数: tf.nn.embedding_lookup( params, ids, partition_strategy='mod', name=None, validate_indices=True, ...

volatility 基本用法

volatility—基本用法

volatility 基本用法相关推荐

最新文章

热门文章