GitHub - volatilityfoundation/volatility: An advanced memory forensics framework
Release Downloads | Volatility Foundation
下载源码
git clone https://github.com/volatilityfoundation/volatility.git
Requirements
- Python 2.6 or later, but not 3.0
- 一些插件，请查看
https://github.com/volatilityfoundation/volatility/wiki/Installation
[root@localhost volatility]# python -V
Python 2.7.5
安装pip，python-devel
#Python 2.7
curl https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
#安装pip
python get-pip.py
#升级pip
python -m pip install -U pip
yum install python-devel
安装依赖
pip install distorm3 pycrypto
准备linux profiles
如果没有适配的Profile，就要自己编写了
git clone https://github.com/volatilityfoundation/profiles.git
将profiles/Linux/CentOS/x64/Centos7-3.10.0-327.36.3.el7.x86_64.zip拷贝到volatility/volatility/plugins/overlays/linux目录，然后解压unzip Centos7-3.10.0-327.36.3.el7.x86_64.zip。
再次查看支持的Profiles
[root@localhost volatility]# python vol.py --info |more
Volatility Foundation Volatility Framework 2.6.1
Profiles
--------
LinuxCentos7-3_10_0-327_36_3_el7_x86_64x64 - A Profile for Linux Centos7-3.10.0-327.36.3.el7.x86_64 x64
VistaSP0x64 - A Profile for Windows Vista SP0 x64
VistaSP0x86 - A Profile for Windows Vista SP0 x86
自己编译profiles
Linux · volatilityfoundation/volatility Wiki · GitHub
- 安装依赖工具
yum install libdwarf-tools,gcc
- 编译
进入volatility/tools/linux/目录，该目录下有需要的Makefile文件
make -C /lib/modules/$(uname -r)/build CONFIG_DEBUG_INFO=y M=$PWD modules
[root@localhost linux]# ls
kcore Makefile Makefile.enterprise module.c
[root@localhost linux]# make -C /lib/modules/$(uname -r)/build CONFIG_DEBUG_INFO=y M=$PWD modules
make: Entering directory `/usr/src/kernels/3.10.0-1160.36.2.el7.x86_64'
CC [M] /root/volatility/tools/linux/module.o
Building modules, stage 2.
MODPOST 1 modules
CC /root/volatility/tools/linux/module.mod.o
LD [M] /root/volatility/tools/linux/module.ko
make: Leaving directory `/usr/src/kernels/3.10.0-1160.36.2.el7.x86_64'
[root@localhost linux]# ls
kcore Makefile Makefile.enterprise module.c module.ko module.mod.c module.mod.o module.o modules.order Module.symvers
dwarfdump -di ./module.o > module.dwarf
[root@localhost linux]# dwarfdump -di ./module.o > module.dwarf
[root@localhost linux]# ls
kcore Makefile Makefile.enterprise module.c module.dwarf module.ko module.mod.c module.mod.o module.o modules.order Module.symvers
将 module.dwarf 和 /boot/System.map-$(uname -r) 打包
[root@localhost linux]# zip CentOS_3.10.0-1160.zip module.dwarf /boot/System.map-$(uname -r)
adding: module.dwarf (deflated 89%)
adding: boot/System.map-3.10.0-1160.36.2.el7.x86_64 (deflated 79%)
[root@localhost linux]# ls
CentOS_3.10.0-1160.zip kcore Makefile Makefile.enterprise module.c module.dwarf module.ko module.mod.c module.mod.o module.o modules.order Module.symvers
分析
将刚才生成的profile文件 CentOS_3.10.0-1160.zip 拷贝到
/root/volatility/volatility/plugins/overlays/linux/目录，并解压unzip CentOS_3.10.0-1160.zip检查profile是否生效
[root@localhost volatility]# python vol.py --info |more
Volatility Foundation Volatility Framework 2.6.1
Profiles
--------
LinuxCentOS_3_10_0-1160x64 - A Profile for Linux CentOS_3.10.0-1160 x64
VistaSP0x64 - A Profile for Windows Vista SP0 x64
...
- 分析文件
[root@localhost volatility]# python vol.py -f /root/ram.lime --profile LinuxCentOS_3_10_0-1160x64 linux_banner
Volatility Foundation Volatility Framework 2.6.1
Linux version 3.10.0-1160.36.2.el7.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Wed Jul 21 11:57:15 UTC 2021
