Linux Memory Forensics - Memory Capture and Analysis
Ғылым және технология
You're likely familiar with many tools that allow us to capture memory from a Windows system, and you may have watched other episodes in which we used Volatility to analyze those captures. But, have you ever wondered how to capture and analyze memory on a Linux system? Well, wait no longer, because that's exactly what we'll cover in this episode!
** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **
📖 Chapters
00:00 - Intro
02:57 - Microsoft AVML
05:14 - Volatility Configuration
09:15 - Volatility Analysis
11:52 - Recap
🛠 Resources
Microsoft AVML:
github.com/microsoft/avml
How to Generate a Volatility Profile for a Linux System:
www.andreafortuna.org/2019/08...
🖥 Commands Used in This Episode
Download and run AVML to create memory capture:
sudo ./avml memory.dmp
Download Volatility:
git clone github.com/volatilityfoundati...
Build custom Volatility profile based upon specific Linux kernel version in use:
cd ./volatility/tools/linux
sudo apt install dwarfdump
make
cd ../../
uname -a (show current kernel version)
sudo zip [DISTRO_KERNEL].zip ./tools/linux/module.dwarf /boot/System.map-[KERNEL VERSION]
Install custom Volatility profile:
mv [DISTRO_KERNEL].zip ./volatility/plugins/overlays/linux
Run Volatility, specifying custom profile, and point at the AVML memory capture:
./vol.py --info | more (verify profile is available)
./vol.py -f /path/to/memory.dmp --profile=[NEW PROFILE NAME] [PLUGIN]
#Forensics #DigitalForensics #DFIR #ComputerForensics #LinuxForensics #MemoryForensics
Пікірлер: 47
I don't know how many tutorials I have tried until I have found yours, the only one that works. Thanks!
Would love more Linux content!
@13Cubed
3 жыл бұрын
WSL 2 in Windows 10 will make that much easier (and more likely)!
Thank you for the great video as always. Compressed, to the point and the important stuff highlighted.
Excellent explanation + Demo. Great job!
This is really awesome content, kindly do more on Linux forensics please.
Great video again as always..
thank you! waiting for more :)
Thank You so much for this tutorial!
Great Video! Definitely find it useful.
thanks for the amazing video mate helped a lot
Please do more about memory forensics, especially on linux!
amazing content!!
Up till now I was using Lime which was very tedious. Didn't tried AVML yet but it would be helpful. Great video Richard
This is great. Thankyou so much
More please!!
thnaks for this video you literally saved my school project
@13Cubed
2 жыл бұрын
Well that's awesome :)
Thank author. Video interesting
Good One
Great, thx
Thanks. Here we took the mem dump and installed volatility in same host .. how if i want to analyze in different workstation?
If you're having an issue with distorm3 not being present when running the pstree process, you'll need to install that (I installed using pip). If you then have issues installing distorm3 (like I did), try installing these: sudo apt-get install build-essential libssl-dev libffi-dev python-dev
Am I right in thinking that you would still need to be running Volatility/Dwarfdump on the target system in order to build the correct profile? My thought to get around that would be to clone the user's hard drive, then boot the clone and install Volatility/dwarfdump to then generate the correct profile.
@13Cubed
3 жыл бұрын
You could also potentially use another machine with the same kernel version to build the correct profile.
Help? "zip warning: name not matched: ./volatility/tools/linux/module.dwarf" module.dwarf does NOT show up in the linux folder, but system says it is installed. Thank you.
Nice one.. Any plan for macos memory forensics?
@13Cubed
3 жыл бұрын
Yes!
Hi Richard... is there any way of deploying AVML from a USB drive? I believe there are issues relating to the FAT file system that prevent this... thanks..
@13Cubed
3 жыл бұрын
I've not tried to run AVML from removable media, so to be honest I do not know. Some testing would need to be performed.
@ashleythomas771
3 жыл бұрын
I have just tested this on a USB drive and had zero issues
@13Cubed
3 жыл бұрын
@@ashleythomas771 Nice!
@williamkeffer8192
3 жыл бұрын
Based on the comment above regarding compromising the system, couldn't you not take this dmp file, and export it to another system? Then use Redline to analyze it? Using this from a usb of course
@13Cubed
3 жыл бұрын
@@williamkeffer8192 I believe he was asking whether or not you could run/execute AVML from removable media. If you are asking if you can take the memory dump and move it to another system for analysis, yes. In real life, that's exactly what you would do (in other words, you would not analyze the memory dump on the system from which it was acquired - this was just a demo/proof of concept). That said, you'd still need the correct Volatility profile in order for the tool to be able to make sense of the memory image. As for Redline 2.0, which now supports Linux/macOS, I have not played with it (yet).
When I run "python vol.py --info | more", obviously after performing each step, error appears Failed to import volatility.plugins.overlays.linux.linux (ValueError: too many values to unpack) and I don't let me create the profile. You can help me please. I don't know why this come out.
@13Cubed
3 жыл бұрын
That is interesting. What are the specifications (OS/kernel version) of the machine on which you are trying this? Can you remove/re-clone the repo and try again with a clean start?
Maan damn your so awesome
when i sudo./avml memory.dmp error : unable to read memory how to fix the problem
@tk_attack
2 жыл бұрын
Happened to me, I think I might not have had enough storage space. I had to make a new system on my virtual box with bigger storage space