VOLSHELL

Presenter Notes

Volatility Python Shell

Allows you to use the full Volatility name space to

  • Interactively explore a memory image
  • write your own scripts
  • Display structure layouts
  • Fill in structures at a memory offset
  • Read memory
  • List processes
  • Switch process context
  • Walk linked lists
  • Disassemble code at a memory offset

Presenter Notes

Getting into Volshell

[root&windows]#volatility -f Win7.bin --profile=Win7SP0x86 volshell
Volatility Foundation Volatility Framework 2.4
Current context: System @ 0x84138bb0, pid=4, ppid=0 DTB=0x185000
Welcome to volshell! Current memory image is:
file:///root/amf/windows/Win7.bin
To get help, type 'hh()'
>>>
>>>> print("HELLO WORLD FROM VOLSHELL")
HELLO WORLD FROM VOLSHELL

Notice Volshell auto places your context to "System"

>>> sc()
Current context: System @ 0x84138bb0, pid=4, ppid=0 DTB=0x185000

Presenter Notes

Help

>>> hh()

Use addrspace() for Kernel/Virtual AS
Use addrspace().base for Physical AS
Use proc() to get the current process object
  and proc().get_process_address_space() for the current process AS
  and proc().get_load_modules() for the current process DLLs

addrspace()                              : Get the current kernel/virtual address space.
cc(offset=None, pid=None, name=None, physical=False) : Change current shell context.
db(address, length=128, space=None)      : Print bytes as canonical hexdump.
dd(address, length=128, space=None)      : Print dwords at address.
dis(address, length=128, space=None, mode=None) : Disassemble code at a given address.
dq(address, length=128, space=None)      : Print qwords at address.
dt(objct, address=None, space=None, recursive=False, depth=0) : Describe an object or show type info.
getmods()                                : Generator for kernel modules (scripting).
getprocs()                               : Generator of process objects (scripting).
hh(cmd=None)                             : Get help on a command.
list_entry(head, objname, offset=-1, fieldname=None, forward=True) : Traverse a _LIST_ENTRY.
modules()                                : Print loaded modules in a table view.
proc()                                   : Get the current process object.
ps()                                     : Print active processes in a table view.
sc()                                     : Show the current context.

For help on a specific command, type 'hh(<command>)'

Presenter Notes

Exploring a Structure

dt(objct, address=None, space=None, recursive=False, depth=0) : Describe an object or show type info.

>>> dt("_LIST_ENTRY")
 '_LIST_ENTRY' (8 bytes)
0x0   : Flink                          ['pointer', ['_LIST_ENTRY']]
0x4   : Blink                          ['pointer', ['_LIST_ENTRY']]

Can use an address to overlay the structure

>>> proc()
[_EPROCESS _EPROCESS] @ 0x84138BB0
>>> dt("_EPROCESS" ,0x84138BB0)
[_EPROCESS _EPROCESS] @ 0x84138BB0
0x0   : Pcb                            2215873456
0x98  : ProcessLock                    2215873608
0xa0  : CreateTime                     2013-10-15 18:45:51 UTC+0000
0xa8  : ExitTime                       1970-01-01 00:00:00 UTC+0000
0xb0  : RundownProtect                 2215873632
0xb4  : UniqueProcessId                4
0xb8  : ActiveProcessLinks             2215873640
0xc0  : ProcessQuotaUsage              -
0xc8  : ProcessQuotaPeak               -
0xd0  : CommitCharge                   12
0xd4  : QuotaBlock                     2190711296
0xd8  : CpuQuotaBlock                  0
0xdc  : PeakVirtualSize                7577600
0xe0  : VirtualSize                    1966080
0xe4  : SessionProcessLinks            2215873684
0xec  : DebugPort                      0
0xf0  : ExceptionPortData              0

Presenter Notes

PS()

Print active processes in a table view.

>>> ps()
Name             PID    PPID   Offset
System           4      0      0x84138bb0
smss.exe         260    4      0x852d95b0
csrss.exe        348    340    0x853f7490
wininit.exe      400    340    0x859c2d40
csrss.exe        412    392    0x859c2030
winlogon.exe     468    392    0x85a11030
services.exe     504    400    0x85a1e410
lsass.exe        520    400    0x85a2d308
lsm.exe          528    400    0x85a315a8
svchost.exe      632    504    0x85ad6530
svchost.exe      700    504    0x85e22530
svchost.exe      748    504    0x85e60530
svchost.exe      868    504    0x85f07648
svchost.exe      908    504    0x85ef03c8
svchost.exe      948    504    0x85eeb328
audiodg.exe      1000   748    0x85f03648
svchost.exe      1204   504    0x85f8c630
spoolsv.exe      1304   504    0x86019b48
svchost.exe      1340   504    0x860621a8
vmtoolsd.exe     1504   504    0x85e2cb38
TPAutoConnSvc.   1668   504    0x8617ab90
dllhost.exe      1804   504    0x8538b030
dllhost.exe      1868   504    0x85e008c8
msdtc.exe        1980   504    0x8613ad40
VSSVC.exe        580    504    0x862007d0
taskhost.exe     320    504    0x86144030
dwm.exe          1916   868    0x86256858
explorer.exe     352    1848   0x8625b420
vmtoolsd.exe     2060   352    0x8628e6d0
TPAutoConnect.   2176   1668   0x862ba8c8
conhost.exe      2184   412    0x862ba248
iexplore.exe     2364   352    0x85e56828
SearchIndexer.   2436   504    0x8633ad40
iexplore.exe     2468   2364   0x8634a380
mstsc.exe        2704   352    0x862f63a0
devenv.exe       2876   352    0x863f63b8
StikyNot.exe     2972   352    0x86452d40
calc.exe         3032   352    0x86480530
WFS.exe          3056   352    0x8533ad40
FXSSVC.exe       3092   504    0x86485030
mspaint.exe      3196   352    0x86499d40
svchost.exe      3232   504    0x864ada20
SnippingTool.e   3276   352    0x864b5d40
wisptis.exe      3364   868    0x86487d40
mobsync.exe      3444   632    0x85358d40
sidebar.exe      3544   352    0x86250770
msra.exe         3676   352    0x84a35030
svchost.exe      3712   504    0x8526ad00
svchost.exe      3744   504    0x861abd40
ProcessHacker.   1108   352    0x863cc540
dllhost.exe      884    632    0x84355d40
cmd.exe          3912   1504   0x842424b8
conhost.exe      3880   348    0x8426ad40
ipconfig.exe     968    3912   0x8426aa50

Presenter Notes

Switching contexts and using them

cc = change context

>>> cc(0x86480530)
Current context: calc.exe @ 0x86480530, pid=3032, ppid=352 DTB=0x3ecec540

You are now in that processes virtual memory

>>> modules()
Offset     Base       Name
0x84131c98 0x82804000 \SystemRoot\system32\ntkrnlpa.exe
0x84131c20 0x82c17000 \SystemRoot\system32\halmacpi.dll
0x84131ba0 0x80bb8000 \SystemRoot\system32\kdcom.dll
0x84131b20 0x82e35000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x84131aa0 0x82eba000 \SystemRoot\system32\PSHED.dll
0x84131a20 0x82ecb000 \SystemRoot\system32\BOOTVID.dll
0x841319a8 0x82ed3000 \SystemRoot\system32\CLFS.SYS
0x84131930 0x82f15000 \SystemRoot\system32\CI.dll

Presenter Notes

More

Let's find the PE header!

>>> dt("_EPROCESS", 0x86480530)
[_EPROCESS _EPROCESS] @ 0x86480530
0x1a8 : Peb                            2147319808
>>> dt("_PEB",2147319808)
0x8   : ImageBaseAddress               1179648
>>> db(1179648)
0x00120000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............
0x00120010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......
0x00120020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00120030  00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00   ................
0x00120040  0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68   ........!..L.!Th
0x00120050  69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f   is.program.canno
0x00120060  74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20   t.be.run.in.DOS.
0x00120070  6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00   mode....$.......

Presenter Notes

Disassemble

dis() is useful to disassemble instructions at some memory location

>>> dis(1179648 + 0x2506)
0x122506 2500000089                       AND EAX, 0x89000000
0x12250b 45                               INC EBP
0x12250c fc                               CLD
0x12250d 8bcb                             MOV ECX, EBX
0x12250f 85c0                             TEST EAX, EAX
0x122511 0f853b190100                     JNZ 0x133e52
0x122517 e8e1fcffff                       CALL 0x1221fd
0x12251c 8b45f8                           MOV EAX, [EBP-0x8]
0x12251f 8b08                             MOV ECX, [EAX]
0x122521 50                               PUSH EAX
0x122522 ff5108                           CALL DWORD [ECX+0x8]

Could just hit random memory and get jibberish, but you could use it on something discovered by malfind() (discussed later in course)

Presenter Notes

TL;DR

Volshell lets you do a whole lot

I will be using it a lot to display structures and just did not want confusion!

Presenter Notes