linux 内存取证_内存取证工具-volatility、foremost

内存取证

1. 内存取证工具volatility

猜测dump文件的profile值

root@kali:~/CTF# volatility -f mem.vmem imageinfo

Volatility Foundation Volatility Framework 2.6

INFO : volatility.debug : Determining profile based on KDBG search...

Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)

AS Layer1 : IA32PagedMemoryPae (Kernel AS)

AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem)

PAE type : PAE

DTB : 0xb18000L

KDBG : 0x80546ae0L

Number of Processors : 1

Image Type (Service Pack) : 3

KPCR for CPU 0 : 0xffdff000L

KUSER_SHARED_DATA : 0xffdf0000L

Image date and time : 2016-05-03 04:41:19 UTC+0000

Image local date and time : 2016-05-03 12:41:19 +0800

root@kali:~/CTF#

看到，profile可能是WinXPSP2x86

直接获取volshell

shell的命令：

dt("内核关键数据结构名称"")

如: dt("_PEB")

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell

Volatility Foundation Volatility Framework 2.6

Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000

Welcome to volshell! Current memory image is:

file:///root/CTF/mem.vmem

To get help, type 'hh()'

>>> dt("_PEB")

'_PEB' (528 bytes)

0x0 : InheritedAddressSpace ['unsigned char']

0x1 : ReadImageFileExecOptions ['unsigned char']

0x2 : BeingDebugged ['unsigned char']

0x3 : SpareBool ['unsigned char']

0x4 : Mutant ['pointer', ['void']]

0x8 : ImageBaseAddress ['pointer', ['void']]

0xc : Ldr ['pointer', ['_PEB_LDR_DATA']]

0x10 : ProcessParameters ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]

0x14 : SubSystemData ['pointer', ['void']]

0x18 : ProcessHeap ['pointer', ['void']]

0x1c : FastPebLock ['pointer', ['_RTL_CRITICAL_SECTION']]

0x20 : FastPebLockRoutine ['pointer', ['void']]

0x24 : FastPebUnlockRoutine ['pointer', ['void']]

0x28 : EnvironmentUpdateCount ['unsigned long']

0x2c : KernelCallbackTable ['pointer', ['void']]

0x30 : SystemReserved ['array', 1, ['unsigned long']]

0x34 : AtlThunkSListPtr32 ['unsigned long']

0x38 : FreeList ['pointer', ['_PEB_FREE_BLOCK']]

0x3c : TlsExpansionCounter ['unsigned long']

0x40 : TlsBitmap ['pointer', ['void']]

0x44 : TlsBitmapBits ['array', 2, ['unsigned long']]

0x4c : ReadOnlySharedMemoryBase ['pointer', ['void']]

0x50 : ReadOnlySharedMemoryHeap ['pointer', ['void']]

0x54 : ReadOnlyStaticServerData ['pointer', ['pointer', ['void']]]

0x58 : AnsiCodePageData ['pointer', ['void']]

0x5c : OemCodePageData ['pointer', ['void']]

0x60 : UnicodeCaseTableData ['pointer', ['void']]

0x64 : NumberOfProcessors ['unsigned long']

0x68 : NtGlobalFlag ['unsigned long']

0x70 : CriticalSectionTimeout ['_LARGE_INTEGER']

0x78 : HeapSegmentReserve ['unsigned long']

0x7c : HeapSegmentCommit ['unsigned long']

0x80 : HeapDeCommitTotalFreeThreshold ['unsigned long']

0x84 : HeapDeCommitFreeBlockThreshold ['unsigned long']

0x88 : NumberOfHeaps ['unsigned long']

0x8c : MaximumNumberOfHeaps ['unsigned long']

0x90 : ProcessHeaps ['pointer', ['array', at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]]

0x94 : GdiSharedHandleTable ['pointer', ['void']]

0x98 : ProcessStarterHelper ['pointer', ['void']]

0x9c : GdiDCAttributeList ['unsigned long']

0xa0 : LoaderLock ['pointer', ['void']]

0xa4 : OSMajorVersion ['unsigned long']

0xa8 : OSMinorVersion ['unsigned long']

0xac : OSBuildNumber ['unsigned short']

0xae : OSCSDVersion ['unsigned short']

0xb0 : OSPlatformId ['unsigned long']

0xb4 : ImageSubsystem ['unsigned long']

0xb8 : ImageSubsystemMajorVersion ['unsigned long']

0xbc : ImageSubsystemMinorVersion ['unsigned long']

0xc0 : ImageProcessAffinityMask ['unsigned long']

0xc4 : GdiHandleBuffer ['array', 34, ['unsigned long']]

0x14c : PostProcessInitRoutine ['pointer', ['void']]

0x150 : TlsExpansionBitmap ['pointer', ['void']]

0x154 : TlsExpansionBitmapBits ['array', 32, ['unsigned long']]

0x1d4 : SessionId ['unsigned long']

0x1d8 : AppCompatFlags ['_ULARGE_INTEGER']

0x1e0 : AppCompatFlagsUser ['_ULARGE_INTEGER']

0x1e8 : pShimData ['pointer', ['void']]

0x1ec : AppCompatInfo ['pointer', ['void']]

0x1f0 : CSDVersion ['_UNICODE_STRING']

0x1f8