Volatility内存取证使用

前言

Volatility是一款开源内存取证框架，能够对导出的内存镜像进行分析，通过获取内核数据结构，使用插件获取内存的详细情况以及系统的运行状态。

而Dumpit是用于生成Windows机器的物理内存转储，可运行在32位/64位系统中，可完美地部署在USB闪存盘上，快速响应事件。

HollowFind插件是用来检测HollowProcoss的Volatility插件。

环境

Volatility 2.5（因为后面使用的hollowfind似乎2.6不支持）
win10
（注意：hollowfind插件只能查win7的）
Vmware 14
win7
python2.7
DumpIt.exe

使用Dumpit生成内存镜像

具体用法参考：
Volatility内存取证使用
生成的是xxx.raw

使用VMware的内存镜像

暂停vm虚拟机 对应的虚拟机文件夹中找到.vmem文件
我这里是win7的虚拟机

安装Volatility

Volatility安装参考教程

安装

python setup.py install

执行
进程列表

python vol.py -f svchost.DMP pslist

使用HollowFind

[翻译]使用HollowFind插件来检测各种进程注入技术
HollowFind原理

python vol.py -f xxxx.vmem --profile=xxxx hollowfind

我是有python2.7和用的powershell 且必须是vmware虚拟机的win7的镜像内存（hollowfind只支持volatility2.5且win7），故这样写：

python27.exe .\vol.py -f ..\replace_process_win7.vmem --profile=Win2008R2SP0x64 hollowfind

运行结果：

PS D:\workspace\2013\Github\volatility-master\volatility-2.5> python27.exe .\vol.py -f ..\replace_process_win7.vmem --profile=Win2008R2SP0x64 hollowfind
Volatility Foundation Volatility Framework 2.5
Hollowed Process Information:Process: GoogleUpdate.e PID: 2912Parent Process: taskeng.exe PPID: 2864Creation Time: 2022-06-14 06:39:27 UTC+0000Process Base Name(PEB): GoogleUpdate.exeCommand Line(PEB): "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cHollow Type: No VAD Entry For Process ExecutableVAD and PEB Comparison:Base Address(VAD): 0x0Process Path(VAD): NAVad Protection: NAVad Tag: NABase Address(PEB): 0xe80000Process Path(PEB): C:\Program Files (x86)\Google\Update\GoogleUpdate.exeMemory Protection: PAGE_EXECUTE_WRITECOPYMemory Tag: VadNo Hexdump: Memory Unreadable at 0x00e80000Similar Processes:GoogleUpdate.e(2912) Parent:taskeng.exe(2864) Start:2022-06-14 06:39:27 UTC+0000GoogleUpdate.e(3708) Parent:GoogleUpdate.e(2912) Start:2022-06-14 06:39:45 UTC+0000GoogleUpdate.e(3784) Parent:GoogleUpdate.e(2912) Start:2022-06-14 06:39:47 UTC+0000Suspicious Memory Regions:0x1a0000(No PE/Possibly Code)  Protection: PAGE_EXECUTE_READWRITE  Tag: VadS
---------------------------------------------------Hollowed Process Information:Process: svchost.exe PID: 892Parent Process: services.exe PPID: 536Creation Time: 2022-06-14 06:39:10 UTC+0000Process Base Name(PEB): svchost.exeCommand Line(PEB): C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedHollow Type: Process Base Address and Memory Protection DiscrepancyVAD and PEB Comparison:Base Address(VAD): 0xff6c0000Process Path(VAD): \Windows\System32\services.exeVad Protection: PAGE_EXECUTE_WRITECOPYVad Tag: VadBase Address(PEB): 0xff550000Process Path(PEB): C:\Windows\System32\svchost.exeMemory Protection: PAGE_EXECUTE_WRITECOPYMemory Tag: Vad0xff550000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............
0xff550010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......
0xff550020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0xff550030  00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00   ................Similar Processes:svchost.exe(892) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(1160) Parent:services.exe(536) Start:2022-06-14 06:39:11 UTC+0000svchost.exe(108) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(3440) Parent:services.exe(536) Start:2022-06-14 06:39:41 UTC+0000svchost.exe(792) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(924) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(1264) Parent:services.exe(536) Start:2022-06-14 06:39:21 UTC+0000svchost.exe(688) Parent:services.exe(536) Start:2022-06-14 06:39:09 UTC+0000svchost.exe(2832) Parent:explorer.exe(2712) Start:2022-06-14 06:39:33 UTC+0000svchost.exe(3260) Parent:ReplaceProcess(3076) Start:2022-06-14 06:40:32 UTC+0000svchost.exe(396) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(952) Parent:services.exe(536) Start:2022-06-14 06:39:10 UTC+0000svchost.exe(1488) Parent:services.exe(536) Start:2022-06-14 06:39:21 UTC+0000Suspicious Memory Regions:0x7feff000000(No PE/Possibly Code)  Protection: PAGE_EXECUTE_WRITECOPY  Tag: Vad
---------------------------------------------------Hollowed Process Information:Process: GoogleUpdate.e PID: 3708Parent Process: GoogleUpdate.e PPID: 2912Creation Time: 2022-06-14 06:39:45 UTC+0000Process Base Name(PEB): GoogleUpdate.exeCommand Line(PEB): "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /crHollow Type: No VAD Entry For Process ExecutableVAD and PEB Comparison:Base Address(VAD): 0x0Process Path(VAD): NAVad Protection: NAVad Tag: NABase Address(PEB): 0xe80000Process Path(PEB): C:\Program Files (x86)\Google\Update\GoogleUpdate.exeMemory Protection: PAGE_EXECUTE_WRITECOPYMemory Tag: VadNo Hexdump: Memory Unreadable at 0x00e80000Similar Processes:GoogleUpdate.e(3708) Parent:GoogleUpdate.e(2912) Start:2022-06-14 06:39:45 UTC+0000GoogleUpdate.e(3784) Parent:GoogleUpdate.e(2912) Start:2022-06-14 06:39:47 UTC+0000GoogleUpdate.e(2912) Parent:taskeng.exe(2864) Start:2022-06-14 06:39:27 UTC+0000Suspicious Memory Regions:0x40000(No PE/Possibly Code)  Protection: PAGE_EXECUTE_WRITECOPY  Tag: Vad
---------------------------------------------------

常见问题

Failed to import volatility.plugins.registry.shutdown (ImportError: XXX

执行时

python27.exe .\vol.py -f D:\workspace\2013\Github\volatility-master\svchost.DMP hollowfind

报错

Volatility Foundation Volatility Framework 2.6.1
*** Failed to import volatility.plugins.registry.shutdown (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.getservicesids (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.timeliner (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.malware.apihooks (NameError: name 'distorm3' is not defined)
*** Failed to import volatility.plugins.malware.servicediff (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.registry.userassist (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.getsids (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.registry.shellbags (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.evtlogs (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.tcaudit (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.registry.dumpregistry (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.registry.lsadump (ImportError: No module named Crypto.Hash)
*** Failed to import volatility.plugins.malware.threads (NameError: name 'distorm3' is not defined)
*** Failed to import volatility.plugins.mac.apihooks_kernel (ImportError: Error loading the diStorm dynamic library (or cannot load library into process).)

解决方案

https://github.com/volatilityfoundation/volatility/issues/535

pip install distorm3 pycrypto openpyxl Pillow

也可以这样 这样pip和python用的就是同一版本

python -m pip install distorm3 pycrypto openpyxl Pillow

No suitable address space mapping found

可参考：https://blog.csdn.net/yingzinanfei/article/details/53150423
可参考：https://github.com/volatilityfoundation/volatility/issues/698
我主要看后面一个kdbgscan可以执行成功了 就根据kdbgscan输出的profile 再添加–profile=xxxx到需要执行的命令中。

python27.exe .\vol.py -f D:\workspace\vms\windows_10_business_editions_version_1903_x64_dvd_e001dd2c.iso\windows_10_business_editions_version_1903_x64_dvd_e001dd2c.iso-6f11cc0a.vmem --profile=Win10x64_18362 pslist