1

I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps.

I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump.vmem

I'm trying to build a tree of dll's imported by a process. Therefore I recursively walk the dll's starting at the process ImageBaseAddress. The problem that occurs is that for some dll's the dllBase is paged and so I can't read the import and delay import directory structures.

I tried disabling the paging in Control Panel -> System -> Advanced -> Perfomance -> Advanced -> Virtual Memory -> No paging file. I also changed the registy entry HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\DisablePagingExecutive from 0 to 1, but the behaviour stays the same.

Another Problem is that even if the dllBase is not paged, sometimes reading the import or delay import directories with PEfile fails although the module / dll has the directory.

Any help is most appreciated.

  • I assume you have a kernel dump, because for a user dump Windows would page in all necessary memory when the Debugger accesses it whiele creating the dump. – Thomas Weller Dec 13 '13 at 15:44
  • DisablePagingExecutive is only for drivers, not for applications, so it shouldn't matter here. – Thomas Weller Dec 13 '13 at 15:47
  • Which debugger do you use to create the dump and how? Especially, did you use SysInternals Livekd? Livekd will not be able to get all memory in reliable state. – Thomas Weller Dec 13 '13 at 15:49
  • Hi Thomas, I run Windows in a VirtualBox VM and create the memory dump with vboxmanage debugvm <vmname> dumpguestcore --filename dump.vmem – user3365 Dec 13 '13 at 16:58
2

The paging file is generally for dirty pages, not for clean ones. The clean ones can be read from the original file directly, so there's no need to store them in the page file (and if they haven't ever been read yet then they won't be in memory at all). Further, delay-load DLLs won't be in memory if they've never been referenced, so anything related to them won't be available to you. So just because you disable paging does not mean that everything will be entirely in memory, if physical memory constraints exist. You could try increasing the size of the physical memory, and perhaps let the process run for longer.

  • What I actually want to do achive by reading the import and delay import directory is to find out which executable VAD's in a process address space are from those imported dlls. As some import directories are not readable for some reason, I end up having executable VAD's that do have a FileObject pointing to a dll but that I can't verify to be imported by the process main module. – user3365 Dec 16 '13 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.