Below is a quick guide for dumping and analyzing windows and linux memory. If you wish to utilize the volitility framework it can be found at volatilityfoundation.org. This guide will help you with some of the challenges available on CyDefe Labs. Check those out at Labs.CyDefe.com

Check back frequently for more guides, tips, and trick with DFIR, pentesting, reverse engineering and much much more. Many of the guides and tips we will be post will help you in real world environments and with our platform. Happy hacking everyone.

MEMORY ACQUSITION

WINPMEM/LINPMEM

1. Windows

a. C:> winpmem_.exe -o F:\mem.aff4

b. C:> winpmem_.exe F:\mem.aff4 -e PhysicalMemory -o mem.raw

1. Linux

a. ./linpmem_.post4 -o F:\mem.aff4

b. ./linpmem_.post4 F:\mem.aff4 -e PhysicalMemory -o mem.raw

1. Linux Alt

a. sudo dd if=/dev/fmem of=/tmp/memory.raw bs=1MB

VOLATILITY USAGE

Example usage: ./volatility__lin64_standalone --profile= -f

LISTING AVAILABLE PROFILES

1. info - Displays a list of profiles

a. ./volatility__lin64_standalone --info

ROGUE PROCESS IDENTIFICATION

1. pslist - High level view of running processes

a. # ./volatility__lin64_standalone --profile= pslist -f

1. psscan - Scan memory for EPROCESS blocks

a. # ./volatility__lin64_standalone --profile= psscan -f

1. pstree - Display parent-process relationships

a. # ./volatility__lin64_standalone --profile= pstree -f

ROOTKIT IDENTIFICATION

1. psxview - Find hidden processes using cross-view

a. # ./volatility__lin64_standalone --profile= psxview -f

1. modscan - Scan memory for loaded, unloaded, and

a. unlinked drivers

i. # ./volatility__lin64_standalone --profile= modscan -f

1. apihooks - Find API/DLL function hooks

a. -p Operate only on specific PIDs

b. -Q Only scan critical processes and DLLS

i. # ./volatility__lin64_standalone --profile= apihooks -f

1. ssdt - Hooks in System Service Descriptor Table

a. # ./volatility__lin64_standalone --profile= ssdt | egrep –v ‘(ntoskrnl|win32k)’ -f

1. driverirp - Identify I/O Request Packet (IRP) hooks

a. -r Analyze drivers matching REGEX name pattern

i. # ./volatility__lin64_standalone --profile= driverirp –r tcpip -f

1. idt - Display Interrupt Descriptor Table

a. # ./volatility__lin64_standalone --profile= idt -f

NETWORK ARTIFACTS

1. Connections - List of open TCP connections

a. # ./volatility__lin64_standalone --profile= connections -f

1. connscan - ID TCP connections, including closed

a. # ./volatility__lin64_standalone --profile= connscan -f

1. sockets - Print listening sockets (any protocol)

a. # ./volatility__lin64_standalone --profile= sockets -f

1. sockscan - ID sockets, including closed/unlinked

a. # ./volatility__lin64_standalone --profile= sockscan -f

1. netscan - Scan for connections and sockets

a. # ./volatility__lin64_standalone --profile= netscan -f