We’re rewarding the question askers & reputations are being recalculated! Read more.
20

You should proceed in two steps: First: You need to have a look on MoonSols Windows Memory Toolkit Community Edition. It will allow You to dump memory to file for further analysis Second: then You'll need Volatility Toolkit to analyze dump file and extract info, binaries, DLLs and more from there. For great sample: of using Volatility - have a look on ...


9

I agree with Denis' answer, but for me, Step 0 is to start FlyPaper, from HBGary. HBGary Flypaper is an invaluable tool in your fight against malware. Most malware is designed into two or three stage deployment. First, a dropper program will launch a second program, and then delete itself. The second program may take additional steps, such as ...


9

The first byte of the file is 0x47, which suggests that it's an MPEG transport stream. I used 010 Editor to create the following template for the file to parse it as an array of Partial Transport Stream Packets: typedef struct { BYTE sync_byte <format=hex>; WORD transport_error_indicator : 1; WORD payload_unit_start_indicator : 1; ...


7

Disassembling You can disassemble in WinDbg at any memory address, e.g. 0:067> db 000007fe`ff4d0000 000007fe`ff4d0000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ.............. 000007fe`ff4d0010 b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 ........@....... 000007fe`ff4d0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ ...


7

The non-linearity is a clue that it's a floating-point encoding. If you are familiar with looking at floating point values in memory dumps, the most significant byte is often in the 0x3f-0x4f range, representing values from 3e-5 to 2e77 for doubles. In this case, it's little-endian. e.g. 00 4C 99 57 38 E5 CC 42 - 21.07.2014 14:38:26 -> unpacks to -> ...


6

It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing. Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but ...


6

There are couple of ways that I could think of. First off, you could use Cuckoo Sandbox. It is an automated malware analysis system. It is open source and its modules are written in Python. To quote the website: Malware! Tear it apart, discover its ins and outs and collect actionable threat data. Cuckoo is the leading open source automated malware ...


5

All the statements below are xp-sp3 based windbg can also be used to parse for RWX pages in VadTree Copy paste following lines to **.txt and run the script $$>a< path to **.txt script contents needs grep in path for text parsing aS proc @#Process ; aS procname @@c++( (char *)(((nt!_EPROCESS *) @#Process ))->ImageFileName ) ; aS ...


5

The netapi.dll might have loaded the dnsapi.dll in order to do some network inspection, and then freed the DLL on completion. However, the shlwapi.dll might hold some handles to objects open for whatever reason, or have a non-zero reference count because of circular loading, and thus remain in memory even after the other DLLs have unloaded. A request to ...


5

As others have mentioned the first thing you should do is dump the memory with MoonSols. This will allow you to do memory analysis using Volatility later. When it comes to malware analysis I find IDA the most useful. In order for it be useful you will need a process dump and a way to rebuild the import table. If the malware can spread to other processes I ...


5

This video on YouTube can be a good start. Reverse Engineering the MOS 6502 CPU [27C3 (Chaos Computer Congress)]. Watching the video from minute 25 to 30 you can see how CPU dice was exposed and how the data were processed. Basically hi-res photos were stitched together and traced to create a vector image. This in turned was used to create a netlist used ...


4

MoonSols and Volatility are one option. Another set of options are Redline and Memoryze, both of which are from Mandiant. An added bonus with Memoryze is that memory acquisition is included.


4

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it using windbg as below windbg -z memory.dmp now i thought i will count how many threads are running so i did some thing like this kd> r $t0 = 0; !...


3

This is so easy to do using nothing but the shell, and probably so specific (since most people want to check more than the heap), that there's probably no real reason to write a command for it. I'd do something like for pid in <whatever you need to get a pid list>; do heap=$(fgrep '[heap]' /proc/$pid/maps) addrs=$(echo $heap | cut -d' ' -f1) ...


3

At a very high level... Reverse engineering typically focuses on recovering the functional specifications of code. Digital forensics typically focuses on recovering data.


3

http://msdn.microsoft.com/en-us/library/windows/hardware/ff562217(v=vs.85) The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.


3

HookShark is a great way of detecting whether anything has patched a process. In my experience it's mostly used when studying the stealth of game hacks. HookShark is a detector of installed hooks and patches installed on the system (only usermode for now). It scans through the code-section of every loaded module of each running process and compares it ...


3

Moonsols is a great option, but I've noticed that there is no longer an option to purchase it and it makes me wonder if support has been stopped. In my opinion, the best way to get started is with win32dd, win64dd, or mdd. Another option that is more automated is DumpIt (created by the maker of Moonsols). I prefer mdd for most tasks, but I have not tested ...


3

I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of: detect/exploit/sniff known interface Like SPI,JTAG,... or even memory interface (address,data and control buses) and do the dump with some MCU to PC adapter attached to it or dump to SD card or what ever. This is not invasive approach but needs to ...


3

The PDF format is not based on XML but uses a PostScript-inspired dictionary format for its "objects" and streams for other data such as images. There are following places where document metadata is stored: the /Info dictionary containing keys such as "Author" , "Producer", "Title" etc. the /Metadata dictionary which may contain an XML stream with ...


3

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. You can use the Process Environment Block (PEB) stored in the _EPROCESS Structure to identify the heap segments. There are three important points, which you ...


2

The paging file is generally for dirty pages, not for clean ones. The clean ones can be read from the original file directly, so there's no need to store them in the page file (and if they haven't ever been read yet then they won't be in memory at all). Further, delay-load DLLs won't be in memory if they've never been referenced, so anything related to them ...


2

winlogon iirc allocates more than 9 RWX pages but does not free only these 9 pages until you create the dump you observe these pages in dump because dump is premature death if you wait sufficiently in shut down/logoff path you can probably catch the VirtualFree()'s i already posted in the previous post you linked that almost all these pages ...


2

First of all, ARM is much easier than Intel because it has fixed instruction length, (if I remember right) requires instructions to be aligned by 2 or 4 and has limited capabilities for arbitrary code self-modification because of its Harvard architecture. I'd like to say that there is no such an algorithm, and in general case such an algorithm is impossible,...


2

I'm quite sure this isn't a pcap file at all, despite what file says, and the D8 doesn't seem to be a network type at all. First, because D8 (216) isn't a valid link type according to http://www.tcpdump.org/linktypes.html. Second, because hexdumping a bit more of the file yields this: 00000000 d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00 ...............


2

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format. There's a newer specification of the file format as well, but it requires registration. Autopsy probably recognizes the file format, so it removes the parts of the file that belong to the file format, not the sector ...


2

The source code for TLSCatch can be downloaded from: https://myollyplugins.googlecode.com/files/TLSCatch.rar And the binary for it can be downloaded from these two locations: https://myollyplugins.googlecode.com/files/TLSCatch.dll http://www.woodmann.com/collaborative/tools/images/Bin_ollytlscatch_2010-11-3_19.7_TlsCatch.zip Furthermore, you can download ...


2

If you know the processor type and if its little or big endian you can search for common opcodes used in functions. for example in x86 its common to see: push ebp mov ebp, esp add esp ... which is 55 8B EC 83 C4 in binary and then search for it in the dump. If you'll find areas which contain your opcodes in high density its probably code.


2

Volatility supports x64 Windows 7 hibernation files as well as x64 images.


Only top voted, non community-wiki answers of a minimum length are eligible