Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the heaps plugin is not working.
Is there any alternatives by which i can extract information from a process heap using volshell or any plugins?
[1] Ligh, Michael Hale, et al. The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory. John Wiley & Sons, 2014.
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
You can use the Process Environment Block (PEB) stored in the _EPROCESS Structure to identify the heap segments. There are three important points, which you should consider:
PEB.ProcessHeap Represents the main heap, which is always
initialized during startup. PEB.NumberOfHeaps A process could
additional create heaps. PEB.ProcessHeaps Pointers to process
heaps, where offset zero points to PEB.ProcessHeap.Another possibility is to explore the VAD structures. The book gives a good introduction to filter processes with the help of vadinfo and vadtree. But you should always consider: The fragments of the heap could only be extracted as long as they are not swapped to disk. Thus, some data could be missing, as those pages haven't been acquired in your dump.
So I will replay an example similar example to the one provided by the book itself. Expecting a running application with a heap of interest.
Let's first extract the process of interest with its corresponding PID:
python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 pslist | grep notepad
Volatility Foundation Volatility Framework 2.6
0xfffffa8000f6c060 notepad.exe 1596 2412 2 56 1 0 2017-08-26 10:17:11 UTC+0000
We examine the heap structure with the help of the vadtree plugin and plot it out:
python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vadtree --output=dot --output-file=graph.dot -p 1596
Inspecting the graph with xdot highlights heaps within the process structure (red nodes):
Start up the volshell by defining your POI with the PID and manually inspect the different VADs:
python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 volshell -p 1596
Volatility Foundation Volatility Framework 2.6
Current context: notepad.exe @ 0xfffffa8000f6c060, pid=1596, ppid=2412 DTB=0x65eb000
Welcome to volshell! Current memory image is:
file:///media/sf_FODEB8/MW-PC-20170826-101847.raw
To get help, type 'hh()'
After some searching (determining 0x00000000001e0000+0x038c20 is your job):
>>> db(0x00000000001e0000+0x038c20, 0xff)
0x00218c20 00 00 00 00 00 00 00 00 8b 2f bd 3e 48 69 00 2e ........./.>Hi..
0x00218c30 0d 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 ....T.h.i.s...i.
0x00218c40 73 00 20 00 73 00 75 00 70 00 65 00 72 00 20 00 s...s.u.p.e.r...
0x00218c50 73 00 65 00 63 00 72 00 65 00 74 00 20 00 2d 00 s.e.c.r.e.t...-.
0x00218c60 20 00 64 00 6f 00 6e 00 27 00 74 00 20 00 73 00 ..d.o.n.'.t...s.
0x00218c70 68 00 61 00 72 00 65 00 20 00 69 00 74 00 20 00 h.a.r.e...i.t...
0x00218c80 77 00 69 00 74 00 68 00 20 00 6f 00 74 00 68 00 w.i.t.h...o.t.h.
0x00218c90 65 00 72 00 20 00 70 00 61 00 72 00 74 00 69 00 e.r...p.a.r.t.i.
0x00218ca0 65 00 73 00 20 00 6f 00 72 00 20 00 70 00 65 00 e.s...o.r...p.e.
0x00218cb0 72 00 73 00 6f 00 6e 00 73 00 2e 00 0d 00 0a 00 r.s.o.n.s.......
0x00218cc0 0d 00 0a 00 0d 00 0a 00 54 00 48 00 49 00 45 00 ........T.H.I.E.
0x00218cd0 46 00 31 00 20 00 3a 00 20 00 49 00 20 00 77 00 F.1...:...I...w.
0x00218ce0 69 00 6c 00 6c 00 20 00 72 00 6f 00 62 00 20 00 i.l.l...r.o.b...
0x00218cf0 74 00 68 00 65 00 20 00 62 00 61 00 6e 00 6b 00 t.h.e...b.a.n.k.
0x00218d00 20 00 6e 00 65 00 78 00 74 00 20 00 77 00 65 00 ..n.e.x.t...w.e.
0x00218d10 65 00 6b 00 20 00 74 00 6f 00 20 00 65 00 61 e.k...t.o...e.a
Another way would be to simply dump the whole VAD structure of the specific process into a folder, and roughly overlook for your expected outputs.
> mkdir vads
> python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vaddump -p 1596 -D vads
Volatility Foundation Volatility Framework 2.6
Pid Process Start End Result
---------- -------------------- ------------------ ------------------ ------
1596 notepad.exe 0x000000007ffe0000 0x000000007ffeffff vads/notepad.exe.1f76c060.0x000000007ffe0000-0x000000007ffeffff.dmp
1596 notepad.exe 0x00000000002e0000 0x00000000003dffff vads/notepad.exe.1f76c060.0x00000000002e0000-0x00000000003dffff.dmp
1596 notepad.exe 0x00000000000d0000 0x000000000014ffff vads/notepad.exe.1f76c060.0x00000000000d0000-0x000000000014ffff.dmp
1596 notepad.exe 0x0000000000040000 0x0000000000041fff vads/notepad.exe.1f76c060.0x0000000000040000-0x0000000000041fff.dmp
[SHORTENED]
vads/notepad.exe.1f76c060.0x000007feff080000-0x000007feff080fff.dmp
1596 notepad.exe 0x000007fffffdc000 0x000007fffffddfff vads/notepad.exe.1f76c060.0x000007fffffdc000-0x000007fffffddfff.dmp
1596 notepad.exe 0x000007fffffd8000 0x000007fffffd8fff vads/notepad.exe.1f76c060.0x000007fffffd8000-0x000007fffffd8fff.dmp
1596 notepad.exe 0x000007fffffde000 0x000007fffffdffff vads/notepad.exe.1f76c060.0x000007fffffde000-0x000007fffffdffff.dmp
Inspecting the dumps reveals:
xxd -a notepad.exe.1f76c060.0x00000000001e0000-0x00000000002dffff.dmp | less
*
0038c20: 0000 0000 0000 0000 8b2f bd3e 4869 002e ........./.>Hi..
0038c30: 0d00 0a00 5400 6800 6900 7300 2000 6900 ....T.h.i.s. .i.
0038c40: 7300 2000 7300 7500 7000 6500 7200 2000 s. .s.u.p.e.r. .
0038c50: 7300 6500 6300 7200 6500 7400 2000 2d00 s.e.c.r.e.t. .-.
0038c60: 2000 6400 6f00 6e00 2700 7400 2000 7300 .d.o.n.'.t. .s.
0038c70: 6800 6100 7200 6500 2000 6900 7400 2000 h.a.r.e. .i.t. .
0038c80: 7700 6900 7400 6800 2000 6f00 7400 6800 w.i.t.h. .o.t.h.
0038c90: 6500 7200 2000 7000 6100 7200 7400 6900 e.r. .p.a.r.t.i.
0038ca0: 6500 7300 2000 6f00 7200 2000 7000 6500 e.s. .o.r. .p.e.
0038cb0: 7200 7300 6f00 6e00 7300 2e00 0d00 0a00 r.s.o.n.s.......
0038cc0: 0d00 0a00 0d00 0a00 5400 4800 4900 4500 ........T.H.I.E.
0038cd0: 4600 3100 2000 3a00 2000 4900 2000 7700 F.1. .:. .I. .w.
0038ce0: 6900 6c00 6c00 2000 7200 6f00 6200 2000 i.l.l. .r.o.b. .
0038cf0: 7400 6800 6500 2000 6200 6100 6e00 6b00 t.h.e. .b.a.n.k.
0038d00: 2000 6e00 6500 7800 7400 2000 7700 6500 .n.e.x.t. .w.e.
0038d10: 6500 6b00 2000 7400 6f00 2000 6500 6100 e.k. .t.o. .e.a.
0038d20: 7200 6e00 2000 6100 2000 7300 6800 6900 r.n. .a. .s.h.i.
0038d30: 7400 2000 7400 6f00 6e00 2000 6f00 6600 t. .t.o.n. .o.f.
0038d40: 2000 6d00 6f00 6e00 6500 7900 2e00 2e00 .m.o.n.e.y.....
0038d50: 2e00 0d00 0a00 5400 4800 4900 4500 4600 ......T.H.I.E.F.
0038d60: 3200 2000 3a00 2000 5300 6f00 7500 6e00 2. .:. .S.o.u.n.
0038d70: 6400 7300 2000 6700 7200 6500 6100 7400 d.s. .g.r.e.a.t.
0038d80: 2000 2100 2000 4c00 6500 7400 2700 7300 .!. .L.e.t.'.s.
0038d90: 2000 6400 6f00 2000 6900 7400 2100 0d00 .d.o. .i.t.!...
0038da0: 0a00 5400 4800 4900 4500 4600 3100 2000 ..T.H.I.E.F.1. .
0038db0: 3a00 2000 4800 6500 7200 6500 2000 6100 :. .H.e.r.e. .a.
0038dc0: 7200 6500 2000 7300 6f00 6d00 6500 2000 r.e. .s.o.m.e. .
0038dd0: 7000 6100 7300 7300 7700 6f00 7200 6400 p.a.s.s.w.o.r.d.
0038de0: 7300 0d00 0a00 5400 4800 4900 4500 4600 s.....T.H.I.E.F.
0038df0: 3100 2000 3a00 2000 7300 7500 7000 6500 1. .:. .s.u.p.e.
0038e00: 7200 5300 6500 6300 7200 6500 7400 3100 r.S.e.c.r.e.t.1.
0038e10: 3300 3300 3700 0d00 0a00 5400 4800 4900 3.3.7.....T.H.I.
0038e20: 4500 4600 3100 2000 3a00 2000 4100 5300 E.F.1. .:. .A.S.
0038e30: 4400 4600 3100 3300 3300 3700 0000 0000 D.F.1.3.3.7.....
You could also take a look in the following plugin.
A better way is to create our own plugin as a fork of the vadinfo.py plugin. That is really easy, even if you don't know Python.
First, get the volatility master from GitHub here.
In your working directory, create a "plugins" directory. From the volatility master, extact the volatility/plugins/vadinfo.py file in this directory. Rename this vadinfo.py as vaddumpheaps.py. Edit the file.
Delete everything but the imports and the VADInfo and VADDump classes.
Add this import:
from volatility.plugins.vadinfo import VADInfo
Rename class VADDump in VADDumpHeaps.
At the end of the __init__() method, add those lines:
config.add_option("HEAPS-ONLY", short_option = 'H', default = False,
action = 'store_true', help = 'Heaps only')
In the render_text() method, look for this loop:
for vad, _addrspace in task.get_vads(vad_filter = filter, skip_max_commit = True):
BEFORE the loop, add this line:
heaps = task.Peb.ProcessHeaps.dereference()
IN the loop, after the first test, add those lines:
if self._config.HEAPS_ONLY and not vad.Start in heaps:
continue
Save the file.
Run volatility-2.6.exe from you directory (that contains the new plugins directory, that contains the new vaddumpheaps.py):
mkdir 666Heaps
volatility-2.6.exe --plugins=plugins -p 666 -D 666Heaps -H vaddumpheaps
This presumes that you created some .volatilityrc file that contains something like this, to avoid having to specify the file and the profile everytime you call volatility-2.6.exe:
[DEFAULT]
PROFILE=Win7SP1x86
LOCATION=file://memory.dmp
The new plugin will dump the VAD heaps only. Very useful.
