php 计算取证,CTF内存取证入门（以安洵杯为例）

[Asm] 纯文本查看 复制代码root@kali:~# volatility -f /root/桌面/mem.dump --profile=Win7SP1x64 pslist

Volatility Foundation Volatility Framework 2.6

Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit

------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------

0xfffffa800ccc1b10 System 4 0 88 534 ------ 0 2019-11-13 08:31:48 UTC+0000

0xfffffa800d2fbb10 smss.exe 252 4 2 29 ------ 0 2019-11-13 08:31:48 UTC+0000

0xfffffa800e2227e0 csrss.exe 344 328 9 400 0 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e3f3340 wininit.exe 396 328 3 79 0 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e3f77d0 csrss.exe 404 388 10 225 1 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e41fb10 winlogon.exe 444 388 3 111 1 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e457060 services.exe 500 396 8 210 0 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e426b10 lsass.exe 508 396 6 554 0 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e464060 lsm.exe 516 396 9 145 0 0 2019-11-13 08:31:49 UTC+0000

0xfffffa800e4f8b10 svchost.exe 608 500 10 351 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e52bb10 svchost.exe 684 500 8 273 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e570b10 svchost.exe 768 500 21 443 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e5b5b10 svchost.exe 816 500 16 381 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e5d7870 svchost.exe 860 500 18 666 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e5f8b10 svchost.exe 888 500 37 919 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e66c870 svchost.exe 1016 500 5 114 0 0 2019-11-13 08:31:50 UTC+0000

0xfffffa800e74fb10 svchost.exe 1032 500 15 364 0 0 2019-11-13 08:31:51 UTC+0000

0xfffffa800e510320 spoolsv.exe 1156 500 13 273 0 0 2019-11-13 08:31:51 UTC+0000

0xfffffa800e5b0060 svchost.exe 1184 500 11 194 0 0 2019-11-13 08:31:51 UTC+0000

0xfffffa800e56e060 svchost.exe 1276 500 10 155 0 0 2019-11-13 08:31:52 UTC+0000

0xfffffa800e685060 svchost.exe 1308 500 12 228 0 0 2019-11-13 08:31:52 UTC+0000

0xfffffa800e632060 svchost.exe 1380 500 4 167 0 0 2019-11-13 08:31:52 UTC+0000

0xfffffa800e692060 VGAuthService. 1480 500 4 94 0 0 2019-11-13 08:31:52 UTC+0000

0xfffffa800e7dab10 vmtoolsd.exe 1592 500 11 287 0 0 2019-11-13 08:31:52 UTC+0000

0xfffffa800e8a7720 svchost.exe 1824 500 6 92 0 0 2019-11-13 08:31:53 UTC+0000

0xfffffa800e898300 WmiPrvSE.exe 1980 608 10 203 0 0 2019-11-13 08:31:53 UTC+0000

0xfffffa800e8e9b10 dllhost.exe 2044 500 15 197 0 0 2019-11-13 08:31:53 UTC+0000

0xfffffa800e90d840 msdtc.exe 1320 500 14 152 0 0 2019-11-13 08:31:54 UTC+0000

0xfffffa800e991b10 taskhost.exe 2208 500 10 264 1 0 2019-11-13 08:31:56 UTC+0000

0xfffffa800e44a7a0 dwm.exe 2268 816 7 144 1 0 2019-11-13 08:31:57 UTC+0000

0xfffffa800e9b8b10 explorer.exe 2316 2260 25 699 1 0 2019-11-13 08:31:57 UTC+0000

0xfffffa800ea4f060 vm3dservice.ex 2472 2316 2 40 1 0 2019-11-13 08:31:57 UTC+0000

0xfffffa800ea54b10 vmtoolsd.exe 2480 2316 9 188 1 0 2019-11-13 08:31:57 UTC+0000

0xfffffa800ea9ab10 rundll32.exe 2968 2620 6 611 1 1 2019-11-13 08:32:02 UTC+0000

0xfffffa800e8b59c0 WmiPrvSE.exe 2764 608 11 316 0 0 2019-11-13 08:32:13 UTC+0000

0xfffffa800ea75b10 cmd.exe 2260 2316 1 20 1 0 2019-11-13 08:33:45 UTC+0000

0xfffffa800e687330 conhost.exe 2632 404 2 63 1 0 2019-11-13 08:33:45 UTC+0000

0xfffffa800e41db10 WmiApSrv.exe 2792 500 4 113 0 0 2019-11-13 08:34:27 UTC+0000

0xfffffa800ed68840 CnCrypt.exe 1608 2316 4 115 1 1 2019-11-13 08:34:40 UTC+0000

0xfffffa800e4a5b10 audiodg.exe 2100 768 6 130 0 0 2019-11-13 08:39:29 UTC+0000

0xfffffa800ea57b10 DumpIt.exe 1072 2316 1 26 1 1 2019-11-13 08:39:43 UTC+0000

0xfffffa800ea1c060 conhost.exe 2748 404 2 62 1 0 2019-11-13 08:39:43 UTC+0000