Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Is it truly possible to use Volatility with Linux memory dumps? #46

Closed
cpuu opened this issue May 1, 2017 · 13 comments
Closed

Is it truly possible to use Volatility with Linux memory dumps? #46

cpuu opened this issue May 1, 2017 · 13 comments

Comments

@cpuu
Copy link

cpuu commented May 1, 2017 •
edited
Loading

(I'm sorry I can not write English well)

Have you guys ever used Volatility Framework with Linux memory dumps, of recent day ?

I have been working hard for a few days.

I think that Volatility is the de facto standard in window analysis, on the other hands, it does not work with Memdump from Linux.

Recent kernel versions appear to have broken compatibility. Even if you use some profiles provided by official github, it doesn't match even if one number is different by 3 decimal points.

I Used LiME and lmg(linux memory grabber) for creating profile and dumping physical memory.
Everything is OK.

but, Volatility cannot parse the data.
I tried CentOS, Ubuntu, Kali Linux, Debian, Fedora .. and so on and so forth.

Every case, this messages shown

No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VMWareMetaAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareAddressSpace: No base Address Space
QemuCoreDumpElf: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
Win10AMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
WindowsCrashDumpSpace64BitMap: Header signature invalid
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VMWareMetaAddressSpace: VMware metadata file is not available
VirtualBoxCoreDumpElf64: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: 0xee300
QemuCoreDumpElf: ELF Header signature invalid
WindowsCrashDumpSpace32: Header signature invalid
Win10AMD64PagedMemory: Incompatible profile Linuxcpuu-VirtualBox-2017-05-01_04_31_48-profilex86 selected
WindowsAMD64PagedMemory: Incompatible profile Linuxcpuu-VirtualBox-2017-05-01_04_31_48-profilex86 selected
LinuxAMD64PagedMemory: Incompatible profile Linuxcpuu-VirtualBox-2017-05-01_04_31_48-profilex86 selected
AMD64PagedMemory: Incompatible profile Linuxcpuu-VirtualBox-2017-05-01_04_31_48-profilex86 selected
IA32PagedMemoryPae: Failed valid Address Space check
IA32PagedMemory: Failed valid Address Space check
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Failed valid Address Space check

—
Was there a mistake in my work? Or does the volatility still not support those versions of Linux?
@deeso
Copy link
Contributor

deeso commented May 1, 2017 via email

@cpuu
Copy link
Author

cpuu commented May 1, 2017 •
edited
Loading

sure, of course, I tried hundreds of times, with tens of kernels(Ubuntu, CentOS, Fedora.. )

volatility 2.6
osboxes@osboxes:~/volatility$ python vol.py --info
Volatility Foundation Volatility Framework 2.6

bold is official profile and others are mine

Profiles

LinuxKali-Linux-2017x64 - A Profile for Linux Kali-Linux-2017 x64
LinuxMyUbuntu1604x64 - A Profile for Linux MyUbuntu1604 x64
LinuxUbuntu16041x64 - A Profile for Linux Ubuntu16041 x64
LinuxUbuntu1604x64 - A Profile for Linux Ubuntu1604 x64
Linuxcpuu-VirtualBox-2017-05-01_04_31_48-profilex86 - A Profile for Linux cpuu-VirtualBox-2017-05-01_04.31.48-profile x86
Linuxosboxes-2017-05-01_07_01_18-profilex86 - A Profile for Linux osboxes-2017-05-01_07.01.18-profile x86
Linuxosboxes-2017-05-01_21_43_17-profilex64 - A Profile for Linux osboxes-2017-05-01_21.43.17-profile x64
Linuxsiftworkstation-2017-05-01_10_06_25-profilex64 - A Profile for Linux siftworkstation-2017-05-01_10.06.25-profile x64

Alright ..

I used linux_pslist , linux_psaux and so on. none of them effect.

Does it cause VirtualBox? why it not works?

@deeso
Copy link
Contributor

deeso commented May 1, 2017 via email

@cpuu
Copy link
Author

cpuu commented May 1, 2017 •
edited
Loading

sure, of course. I am doing well on Windows cases.. but why it does not show the results only in Linux.. I don't know what to do

@deeso
Copy link
Contributor

deeso commented May 1, 2017

I meant to ask for the specific command you are running. I am trying to set context and identify the root cause of the problem. Can you share the exact command you are running?

@cpuu
Copy link
Author

cpuu commented May 1, 2017 •
edited
Loading

When I use lmg usb style :
sudo python vol.py --conf-file=../capture/osboxes-2017-05-01_21.43.17/volatilityrc linux_bash | head
sudo python vol.py --conf-file=../capture/osboxes-2017-05-01_21.43.17/volatilityrc linux_psaux
in volatilityrc file :
cpuu@osboxes:/media/cpuu/LinuxMemoryGrab/lmg/capture/osboxes-2017-05-01_21.43.17$ cat volatilityrc [DEFAULT] PLUGINS=/media/cpuu/LinuxMemoryGrab/lmg/capture/osboxes-2017-05-01_21.43.17 PROFILE=Linuxosboxes-2017-05-01_21_43_17-profilex64 LOCATION=file:////media/cpuu/LinuxMemoryGrab/lmg/capture/osboxes-2017-05-01_21.43.17/osboxes-2017-05-01_21.43.17-memory.lime

but it not works!

So I copied the files on local system volatility dir, profile is in
/home/osboxes/volatility/volatility/plugins/overlays/linux

osboxes@osboxes:~/volatility$ python vol.py --info
shows me below very well.
profiles :
Linuxosboxes-2017-05-01_21_43_17-profilex64 - A Profile for Linux osboxes-2017-05-01_21.43.17-profile x64

now that I try ..

sudo python vol.py -f ../Desktop/osboxes-2017-05-01_21.43.17-memory.lime --profile=Linuxosboxes-2017-05-01_21_43_17-profilex64 linux_pslist

not works!

@deeso
Copy link
Contributor

deeso commented May 1, 2017 via email

@cpuu
Copy link
Author

cpuu commented May 1, 2017

Oh I have not heard about that. I will search that way and try it/

@atcuno
Copy link
Contributor

atcuno commented May 1, 2017 via email

@cpuu
Copy link
Author

cpuu commented May 1, 2017 •
edited
Loading

I tried Ubuntu, Fedora, CentOS and so on.

especially, choose one distro, Ubuntu 16.04.1

uname -a
Linux osboxes 4.8.0-49-generic #52~16.04.1-Ubuntu SMP Thu Apr 20 10:55:59 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
This is virtualbox for windows version 5.0.26 r108824

When I did it on the real Linux machine .
Linux sep_gpu1 4.2.0-38-generic #45~14.04.1-Ubuntu SMP Thu Jun 9 09:27:51 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Both cases (each case has memdump itself) do not work.

All case was dumped by LiME.
I will try using other dumper (/dev/kmem ? ) and report them soon.

@cpuu
Copy link
Author

cpuu commented May 2, 2017

I did with VMware Workstation (not Virtual Box)
on the 4.4.0-31-generic Ubuntu 14.04

python vol.py --conf-file=../capture/ubuntu-2017-05-02_08.36.09/volatilityrc linux_pslist
Volatility Foundation Volatility Framework 2.6
Offset Name Pid PPid Uid Gid DTB Start Time

0xffff88003cc60000 init 1 0 0 0 0x000000003cac1000 2017-05-02 15:27:55 UTC+0000
0xffff88003cc60dc0 kthreadd 2 0 0 0 ------------------ 2017-05-02 15:27:55 UTC+0000
0xffff88003cc61b80 ksoftirqd/0 3 2 0 0 ------------------ 2017-05-02 15:27:55 UTC+0000
0xffff88003cc62940 kworker/0:0 4 2 0 0 ------------------ 2017-05-02 15:27:55 UTC+0000
0xffff88003cc63700 kworker/0:0H 5 2 0 0 ------------------ 2017-05-02 15:27:55

it works!!! oh shit... My effort was wasted...
is it virtual box flaw ? i have no idea. but i did!!

@deeso
Copy link
Contributor

deeso commented May 2, 2017 via email

@bneuburg
Copy link

bneuburg commented May 3, 2017

If you are using LiME to acquire memory try passing the timeout=0 module parameter when modprobing. This bit me a few times when trying to dump the memory from a KVM virtual machine. It's possible that VirtualBox is too slow in returning some of the memory pages and in this case LiME will just write zeroes instead of waiting.

@atcuno atcuno closed this as completed Dec 8, 2017
@mthbrown mthbrown mentioned this issue Sep 8, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@atcuno @deeso @bneuburg @cpuu