2

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the heaps plugin is not working.

Is there any alternatives by which i can extract information from a process heap using volshell or any plugins?

[1] Ligh, Michael Hale, et al. The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory. John Wiley & Sons, 2014.

2

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.

You can use the Process Environment Block (PEB) stored in the _EPROCESS Structure to identify the heap segments. There are three important points, which you should consider:

  • PEB.ProcessHeap Represents the main heap, which is always initialized during startup.
  • PEB.NumberOfHeaps A process could additional create heaps.
  • PEB.ProcessHeaps Pointers to process heaps, where offset zero points to PEB.ProcessHeap.

Another possibility is to explore the VAD structures. The book gives a good introduction to filter processes with the help of vadinfo and vadtree. But you should always consider: The fragments of the heap could only be extracted as long as they are not swapped to disk. Thus, some data could be missing, as those pages haven't been acquired in your dump.

So I will replay an example similar example to the one provided by the book itself. Expecting a running application with a heap of interest.

enter image description here

Let's first extract the process of interest with its corresponding PID:

python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 pslist | grep notepad
Volatility Foundation Volatility Framework 2.6
0xfffffa8000f6c060 notepad.exe            1596   2412      2       56      1      0 2017-08-26 10:17:11 UTC+0000 

We examine the heap structure with the help of the vadtree plugin and plot it out:

python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vadtree --output=dot --output-file=graph.dot -p 1596

Inspecting the graph with xdot highlights heaps within the process structure (red nodes):

enter image description here

Start up the volshell by defining your POI with the PID and manually inspect the different VADs:

python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 volshell -p 1596
Volatility Foundation Volatility Framework 2.6
Current context: notepad.exe @ 0xfffffa8000f6c060, pid=1596, ppid=2412 DTB=0x65eb000
Welcome to volshell! Current memory image is:
file:///media/sf_FODEB8/MW-PC-20170826-101847.raw
To get help, type 'hh()'

After some searching (determining 0x00000000001e0000+0x038c20 is your job):

>>> db(0x00000000001e0000+0x038c20, 0xff)
0x00218c20  00 00 00 00 00 00 00 00 8b 2f bd 3e 48 69 00 2e   ........./.>Hi..
0x00218c30  0d 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00   ....T.h.i.s...i.
0x00218c40  73 00 20 00 73 00 75 00 70 00 65 00 72 00 20 00   s...s.u.p.e.r...
0x00218c50  73 00 65 00 63 00 72 00 65 00 74 00 20 00 2d 00   s.e.c.r.e.t...-.
0x00218c60  20 00 64 00 6f 00 6e 00 27 00 74 00 20 00 73 00   ..d.o.n.'.t...s.
0x00218c70  68 00 61 00 72 00 65 00 20 00 69 00 74 00 20 00   h.a.r.e...i.t...
0x00218c80  77 00 69 00 74 00 68 00 20 00 6f 00 74 00 68 00   w.i.t.h...o.t.h.
0x00218c90  65 00 72 00 20 00 70 00 61 00 72 00 74 00 69 00   e.r...p.a.r.t.i.
0x00218ca0  65 00 73 00 20 00 6f 00 72 00 20 00 70 00 65 00   e.s...o.r...p.e.
0x00218cb0  72 00 73 00 6f 00 6e 00 73 00 2e 00 0d 00 0a 00   r.s.o.n.s.......
0x00218cc0  0d 00 0a 00 0d 00 0a 00 54 00 48 00 49 00 45 00   ........T.H.I.E.
0x00218cd0  46 00 31 00 20 00 3a 00 20 00 49 00 20 00 77 00   F.1...:...I...w.
0x00218ce0  69 00 6c 00 6c 00 20 00 72 00 6f 00 62 00 20 00   i.l.l...r.o.b...
0x00218cf0  74 00 68 00 65 00 20 00 62 00 61 00 6e 00 6b 00   t.h.e...b.a.n.k.
0x00218d00  20 00 6e 00 65 00 78 00 74 00 20 00 77 00 65 00   ..n.e.x.t...w.e.
0x00218d10  65 00 6b 00 20 00 74 00 6f 00 20 00 65 00 61      e.k...t.o...e.a

Another way would be to simply dump the whole VAD structure of the specific process into a folder, and roughly overlook for your expected outputs.

> mkdir vads
> python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vaddump -p 1596 -D vads
Volatility Foundation Volatility Framework 2.6
Pid        Process              Start              End                Result
---------- -------------------- ------------------ ------------------ ------
      1596 notepad.exe          0x000000007ffe0000 0x000000007ffeffff vads/notepad.exe.1f76c060.0x000000007ffe0000-0x000000007ffeffff.dmp
      1596 notepad.exe          0x00000000002e0000 0x00000000003dffff vads/notepad.exe.1f76c060.0x00000000002e0000-0x00000000003dffff.dmp
      1596 notepad.exe          0x00000000000d0000 0x000000000014ffff vads/notepad.exe.1f76c060.0x00000000000d0000-0x000000000014ffff.dmp
      1596 notepad.exe          0x0000000000040000 0x0000000000041fff vads/notepad.exe.1f76c060.0x0000000000040000-0x0000000000041fff.dmp
      [SHORTENED]
      vads/notepad.exe.1f76c060.0x000007feff080000-0x000007feff080fff.dmp
      1596 notepad.exe          0x000007fffffdc000 0x000007fffffddfff vads/notepad.exe.1f76c060.0x000007fffffdc000-0x000007fffffddfff.dmp
      1596 notepad.exe          0x000007fffffd8000 0x000007fffffd8fff vads/notepad.exe.1f76c060.0x000007fffffd8000-0x000007fffffd8fff.dmp
      1596 notepad.exe          0x000007fffffde000 0x000007fffffdffff vads/notepad.exe.1f76c060.0x000007fffffde000-0x000007fffffdffff.dmp

Inspecting the dumps reveals:

xxd -a notepad.exe.1f76c060.0x00000000001e0000-0x00000000002dffff.dmp | less

  *
  0038c20: 0000 0000 0000 0000 8b2f bd3e 4869 002e  ........./.>Hi..
  0038c30: 0d00 0a00 5400 6800 6900 7300 2000 6900  ....T.h.i.s. .i.
  0038c40: 7300 2000 7300 7500 7000 6500 7200 2000  s. .s.u.p.e.r. .
  0038c50: 7300 6500 6300 7200 6500 7400 2000 2d00  s.e.c.r.e.t. .-.
  0038c60: 2000 6400 6f00 6e00 2700 7400 2000 7300   .d.o.n.'.t. .s.
  0038c70: 6800 6100 7200 6500 2000 6900 7400 2000  h.a.r.e. .i.t. .
  0038c80: 7700 6900 7400 6800 2000 6f00 7400 6800  w.i.t.h. .o.t.h.
  0038c90: 6500 7200 2000 7000 6100 7200 7400 6900  e.r. .p.a.r.t.i.
  0038ca0: 6500 7300 2000 6f00 7200 2000 7000 6500  e.s. .o.r. .p.e.
  0038cb0: 7200 7300 6f00 6e00 7300 2e00 0d00 0a00  r.s.o.n.s.......
  0038cc0: 0d00 0a00 0d00 0a00 5400 4800 4900 4500  ........T.H.I.E.
  0038cd0: 4600 3100 2000 3a00 2000 4900 2000 7700  F.1. .:. .I. .w.
  0038ce0: 6900 6c00 6c00 2000 7200 6f00 6200 2000  i.l.l. .r.o.b. .
  0038cf0: 7400 6800 6500 2000 6200 6100 6e00 6b00  t.h.e. .b.a.n.k.
  0038d00: 2000 6e00 6500 7800 7400 2000 7700 6500   .n.e.x.t. .w.e.
  0038d10: 6500 6b00 2000 7400 6f00 2000 6500 6100  e.k. .t.o. .e.a.
  0038d20: 7200 6e00 2000 6100 2000 7300 6800 6900  r.n. .a. .s.h.i.
  0038d30: 7400 2000 7400 6f00 6e00 2000 6f00 6600  t. .t.o.n. .o.f.
  0038d40: 2000 6d00 6f00 6e00 6500 7900 2e00 2e00   .m.o.n.e.y.....
  0038d50: 2e00 0d00 0a00 5400 4800 4900 4500 4600  ......T.H.I.E.F.
  0038d60: 3200 2000 3a00 2000 5300 6f00 7500 6e00  2. .:. .S.o.u.n.
  0038d70: 6400 7300 2000 6700 7200 6500 6100 7400  d.s. .g.r.e.a.t.
  0038d80: 2000 2100 2000 4c00 6500 7400 2700 7300   .!. .L.e.t.'.s.
  0038d90: 2000 6400 6f00 2000 6900 7400 2100 0d00   .d.o. .i.t.!...
  0038da0: 0a00 5400 4800 4900 4500 4600 3100 2000  ..T.H.I.E.F.1. .
  0038db0: 3a00 2000 4800 6500 7200 6500 2000 6100  :. .H.e.r.e. .a.
  0038dc0: 7200 6500 2000 7300 6f00 6d00 6500 2000  r.e. .s.o.m.e. .
  0038dd0: 7000 6100 7300 7300 7700 6f00 7200 6400  p.a.s.s.w.o.r.d.
  0038de0: 7300 0d00 0a00 5400 4800 4900 4500 4600  s.....T.H.I.E.F.
  0038df0: 3100 2000 3a00 2000 7300 7500 7000 6500  1. .:. .s.u.p.e.
  0038e00: 7200 5300 6500 6300 7200 6500 7400 3100  r.S.e.c.r.e.t.1.
  0038e10: 3300 3300 3700 0d00 0a00 5400 4800 4900  3.3.7.....T.H.I.
  0038e20: 4500 4600 3100 2000 3a00 2000 4100 5300  E.F.1. .:. .A.S.
  0038e30: 4400 4600 3100 3300 3300 3700 0000 0000  D.F.1.3.3.7.....

You could also take a look in the following plugin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.