Acquiring Memor(ies) from 2014

2014 is extremely volatile. Any minute now, it will be gone. Thus, we wanted to take a minute and preserve some of the more exciting memories. Specifically, we wanted to summarize how the memory forensics field and Volatility community has progressed this year.

• Volatility 2.4 was released - our most stable and fully featured code base, supporting all of the major versions of Windows, Linux, and Mac. The release includes Windows 8 and Server 2012 support, despite the encrypted debugging structures. Windows 10 beta support is also available.
• We also moved to Github, which makes it easier for other developers to submit patches and pull requests. A separate repository stores Linux and Mac profiles. The 2.5 release is also under way. 
• Extraction of TrueCrypt cached passwords and master keys become even easier than it was before, with new plugins that execute a structured approach at locating and recovering the data. The capability was also ported to Linux, and a member of the community completed a similar plugin for dm-crypt.
• Our 5-day hands-on Malware and Memory Forensics training course proliferated to over 10 events (public and private) across the United States, Europe, and Australia. Testimonials from attendees are available here and registration is open for classes in 2015.
• The Volatility Foundation was established as a 501(c)(3) non-profit organization. A new website was created to aggregate the foundation's resources. Among other things, the site describes the various ways to get involved with the community. The Volatility(R) name also became a registered trademark of the Volatility Foundation.
• Volexity, LLC became a corporate sponsor of the Volatility Foundation and named core developer Michael Hale Ligh as its CTO. Volexity is a security firm based out of the Washington, D.C. area that specializes in assisting organizations with threat intelligence, incident response, forensics, and trusted security advisory.
• The Volatility Plugin Contest received an extremely generous donation from Facebook and generated an enormous amount of new capabilities from various talented developers and researchers. 
• The Volatility Team partnered with GMG Systems, Inc. to offer KnTTools (incl. KnTDD) at a discounted rate to students in our training course. KnTTools is the most reliable, robust, and fully featured memory acquisition suite for Windows. 
• Volatility and memory forensics were represented at almost all security and technology related conferences, including (but not limited to) Blackhat USA, Defcon, OMFW, OSDFC, API Cybersecurity, SecTor, Archc0n, Alabama Cyber Security Summit, National Cyber Crime Conference, RSA USA, BSides, and Recon.
• Volatility was used by Det. Michael Chaves to track down high profile ATM skimmers. It was used by European law enforcement to produce the primary source of evidence that put away a child sex offender for over 10 years. It was used by the United States Government on various occasions to investigate cases involving espionage, cyber terrorism, and major botnet rings.
• Volatility developer Andrew Case and Golden G. Richard III won best paper at DFRWS 2014 for In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux.
• We enjoyed a record breaking number of attendees at Open Memory Forensics Workshop (OMFW) 2014 and a serious group of awesome talks. Later that week, Next Generation Memory Forensics was presented at OSDFC. 
• The Art of Memory Forensics was published in August, a 900-page book that covers Windows, Linux, and Mac topics in depth. To date, its the most thorough and illustrative written source of memory forensics knowledge. Please remember to check the errata page and also the sample memory images that are accompanied with lab questions and answers (free online download). 
• A Reddit Ask Me Anything (AMA) was conducted on Art of Memory Forensics. We appreciate all the great questions!  
• An entire chapter of Black Hat Python was devoted to using Volatility for offensive purposes during pentests (extracting password hashes, injecting code, etc). 
• We presented some Volatility capabilities at Blackhat Arsenal and later created a YouTube channel with recordings of the demos. There was also a book signing in the Blackhat bookstore, which was an exciting way for us to meet new Volatility users in person.

 Thanks to all who played a part! We look forward to an even more productive 2015!

The Secret to 64-bit Windows 8 and 2012 Raw Memory Dump Forensics

Those of you who attended OMFW 2013 received a talk on Windows 8 and Server 2012 memory forensics with Volatility. One of the interesting aspects of this new operating system, which includes 8.1 and 2012 R2, is that the kernel debugger data block (_KDDEBUGGER_DATA64) is encoded by default on the 64-bit versions. As noted in Takahiro Haruyama's blog, this capability has been present since Vista, but only enabled in certain situations. Whether you're dealing with one of those special circumstances from a Vista/2008/7 system, or if you're analyzing memory from a more recent Windows 8 or 2012 system, the question remains -- what can you do about it?

An encoded KDBG can have a hugely negative effect on your ability to perform memory forensics. This structure contains a lot of critical details about the system, including the pointers to the start of the lists of active processes and loaded kernel modules, the address of the PspCid handle table, the ranges for the paged and non-paged pools, etc. If all of these fields are encoded, your day becomes that much more difficult.

>>> dt("_KDDEBUGGER_DATA64")
'_KDDEBUGGER_DATA64' (832 bytes)
0x0   : Header                      ['_DBGKD_DEBUG_DATA_HEADER64']
0x18  : KernBase                    ['unsigned long long']
0x20  : BreakpointWithStatus        ['unsigned long long']
0x28  : SavedContext                ['unsigned long long']
0x30  : ThCallbackStack             ['unsigned short']
0x32  : NextCallback                ['unsigned short']
0x34  : FramePointer                ['unsigned short'] 
0x38  : KiCallUserMode              ['unsigned long long']
0x40  : KeUserCallbackDispatcher    ['unsigned long long']
0x48  : PsLoadedModuleList          ['pointer', ['_LIST_ENTRY']]
0x50  : PsActiveProcessHead         ['pointer', ['_LIST_ENTRY']]
0x58  : PspCidTable                 ['pointer', ['pointer', ['_PSP_CID_TABLE']]]
[snip]

As Takahiro points out, acquiring memory in crash dump format may help you evade this problem altogether, because some APIs used to create crash dumps will automatically decode the data before writing it to the crash dump file. They do this so Microsoft's debugger (Windbg) can find and read the structure when necessary. In fact, by simply attaching a kernel debugger to a target system, the KDBG structure will be decoded. However, tools that acquire memory in raw format (with no headers, no meta-data, etc.) will not preemptively decode the data, and raw memory dumps, including virtual machine snapshot memory files, are by far the most common format -- since practically all analysis tools accept them as input.

The answer to the problem lies within the NT kernel module, specifically in a function named KdCopyDataBlock. Here you will find a few variables, such as KiWaitNever and KiWaitAlways which are set based on the value of the timestamp counter (RDTSC) when the system boots (these values are also involved in pointer obfuscation for Patchguard2). Using those values in combination with a small formula, which we tweeted back in July 2013, you can fully decode the KDBG structure in raw memory dumps and access its members per the usual.

When you execute Volatility against a raw memory dump (or any memory dump format for that matter) that contains an encoded KDBG structure, it will first find the KiWaitNever, KiWaitAlways, and few other required sources of entropy. Then it will find the KDBG structure, despite the fact that its encoded, and use the previously found values to decode it. The plain-text data is stored in the memory of the Volatility process, not written back to your memory dump file. As a result, from the end-user's perspective, nothing has really changed. You go about your analysis in the same way you always do:

The build of Volatility that supports 32- and 64-bit Windows 8, 8.1, 2012, and 2012 R2 is currently being beta-tested by students who participate in our training classes, as well as by a few select members of the community. We hope you're as excited about this new capability as we are!

What's Happening in the World of Volatility?

Volatility is not just an advanced open-source memory forensics framework for Windows, Linux, Mac, and Android. Its a community, an attitude, a lifestyle, and every day it grows in popularity, maturity, and integrity. This post will summarize some of the upcoming excitement involving Volatility, its developers, and its users.

First and foremost, Volatility 2.3 will enter its Beta mode this week. It has been a long time coming and we're proud to finally be nearly finished with the code base. To introduce you to what's new in 2.3, we'll be commencing the second MoVP (Month of Volatility Plugins) this week as well. That's one post every day for four weeks winding down to the final release of 2.3. The posts will be categorized like this:

Week 1: New Address Spaces
Week 2: New and Improved Windows Plugins
Week 3: Linux and Android Capabilities
Week 4: Mac OSX Support

If you're interested in our Malware and Memory Forensics training course, we now have three options that are open for registration. This is a 5-day class taught directly by core Volatility developers. We'll be by your side, at your computer, giving you individualized attention and helping you work through hands-on assignments that teach you how to apply memory forensics to your jobs in malware analysis and incident response.

June 10th in Reston, VA (act fast, this one is nearly sold out)
September 9th in The Netherlands (act fast, this one is nearly sold out)
November 11th in Vermont

To inquire about an event, email us at voltraining@memoryanalysis.net. The next events are expected to be in San Francisco and New York, so stay tuned.

We also want to remind you of the active plugin contest that awards over $2250 in cash, a free seat at a training event in the future, and other prizes such as Volatility swag (T-shirts, stickers, etc). If you're thinking of developing an extension to the Volatility framework that you think is creative and worthwhile, submit it for a chance to win. Based on the ideas we've seen so far, this is going to be a very exciting contest with some awesome submissions.

This year's OMFW (Open Memory Forensics Workshop) will take place in Chantilly, VA on November 4th 2013; alongside OSDFC (Open Source Digital Forensics Conference). Some of the field's most ground-breaking research has been presented at OMFW over the past few years, so we're excited to see what this year brings. Stay tuned for the OMFW Call For Papers. Also, it looks like OSDFC received submissions of at least 4 talks that plan to cover Volatility in some way. If you want to see them, vote to get them a space in the lineup.

Speaking of voting, Volatility or Volatility developers were nominated for almost every category of this year's Forensic 4cast Awards, besides the ones that deal with phone forensics or books. If you have not done so yet, cast your vote!

Stay tuned for more exciting news on Volatility coming later this summer. You may also want to join the Volatility Users mailing list and follow @volatility on Twitter if you don't already.

OMFW 2012: Mining the PFN Database for Malware Artifacts

There are few people in the world who know more about physical memory acquisition and analysis than Mr. Garner; President of GMG Systems, Inc. and author of KnTTools. At a rare conference appearance, George discussed how he leverages the PFN database to attribute pages of physical memory to owning processes and drivers. This OMFW talk was enlightening, as George shared stories of tracking single UDP packets between hosts in China, his experiences single-stepping through the Windows kernel, and how he tracked a TDI object with an NTFS pool tag in deallocated memory.

Author/Presenter: George M. Garner Jr. (GMG Systems, Inc.)
Direct Link: Mining the PFN Database for Malware Artifacts

OMFW 2012: The Analysis of Process Token Privileges

Reverse engineering windows systems nowadays involves looking at static data, such as executables, symbols, pdbs, and/or dynamic data when debugging with a tool like windbg. Determining data structures and the meaning of their content has proven to be time consuming, especially when dealing with undocumented objects. This presentation tackles the problem by describing a novel approach, which utilizes the Volatility Framework and F-response to monitor changes taking place on a live system’s RAM that appear as a result of manipulating the targeted structures’ content. The technique is used in the discovery of the process privileges on Windows operating systems and the development of a new plugin. The presentation also provides examples of how the new plugin is used to discover malicious activity.

Author/Presenter: Cem Gurkok
Direct Link: The Analysis of Process Token Privileges

MoVP for Volatility 2.2 and OMFW 2012 Wrap-Up

The Month of Volatility Plugins and Open Memory Forensics Workshop 2012 have now come to an end. Volatility 2.2 has been released. We hope you enjoyed spending time with us learning about the new features and innovative research that's being built into the framework. At the same time, we'd like to thank everyone who *contributes to the framework in one way or another; especially those who write code (see CREDITS.txt in the source package) and share their analyses.

* this excludes people who write plugins that implement a subset of the functionality of existing plugins and then charge excessive fees to teach you about it. You know who you are!

In the meantime, we've already started development on Volatility 2.3 and expect an RC1 date in December 2012. Will there be enough new features in 2.3 for another Month of Volatility Plugins? Action packed is how we like it, so you'll have to wait and see!

Open Memory Forensics Workshop 

• Datalore: Android Memory Analysis by Joe Sylve (@jtsylve)
• Malware in the Windows GUI Subsystem by Michael Ligh (@iMHLv2)
• Reconstructing the MBR and MFT from Memory by Jamie Levy (@gleeda)
• Analyzing Linux Rootkits with Volatility by Andrew Case (@attrc)
• More online slides are expected soon

Month of Volatility Plugins 

Week One:

• MoVP 1.1 Logon Sessions, Processes, and Images
• MoVP 1.2 Window Stations and Clipboard Malware
• MoVP 1.3 Desktops, Heaps, and Ransomware
• MoVP 1.4 Average Coder Rootkit, Bash History, and Elevated Processes
• MoVP 1.5 KBeast Rootkit, Detecting Hidden Modules, and sysfs 

Week Two:

• MoVP 2.1 Atoms (The New Mutex), Classes, and DLL Injection 
• MoVP 2.2 Malware In Your Windows
• MoVP 2.3 Event Logs and Service SIDs
• MoVP 2.4 Analyzing the Jynx Rootkit and LD_PRELOAD
• MoVP 2.5 Investigating In-Memory Network Data with Volatility 

Week Three:

• MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem
• MoVP 3.2 Shellbags in Memory, SetRegTime and TrueCrypt Volumes
• MoVP 3.3 Analyzing USER Handles and the Win32k.sys Gahti 
• MoVP 3.4 Recovering tagCLIPDATA: What's In Your Clipboard?
• MoVP 3.5 Analyzing the 2008 DFRWS Challenge with Volatility

Week Four:

• MoVP 4.1 Detecting Malware with GDI Timers and Callbacks
• MoVP 4.2 Taking Screenshots From Memory Dumps
• MoVP 4.3 Recovering Master Boot Records (MBRs) from Memory
• MoVP 4.4 Cache Rules Everything Around Me(mory)
• MoVP 4.5 Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit 

OMFW 2012: Datalore: Android Memory Analysis

This presentation went over the Android specific analysis capabilities of Volatility as well as showed how to use LiME to capture physical memory from Android devices. This functionality will be included in the 2.3 Volatility release.

Author/Presenter: Joe Sylve / @jtsylve
Direct Link: Datalore: Android Memory Analysis

OMFW 2012: Analyzing Linux Kernel Rootkits with Volatility

This presentation went over a number of the new Linux plugins and showed how to use them when investigating Linux kernel rootkits. All of the plugins and functionality shown is part of the 2.2 Volatility release.

Author/Presenter: Andrew Case / @attrc
Direct Link: Analyzing Linux Kernel Rootkits with Volatility

OMFW 2012: Reconstructing the MBR and MFT from Memory

This presentation introduced two new Volatility plugins: mbrparser and mftparser which will be released in Volatility 2.3.  These plugins empower the investigator to explore possible MBR infections or in the case of mftparser, files that are in use on the system.   There are real examples in the slides which you can view for yourself.  You can find the mbrparser plugin in the Volatility 2.3 branch and the mftparser will appear there sometime soon. Feel free to send feedback.

Author/presenter: Jamie "Gleeda" Levy (@gleeda)
Direct link: Reconstructing the MBR and MFT from Memory

OMFW 2012: Malware In the Windows GUI Subsystem

This presentation introduced Volatility's new win32k suite - a set of plugins and APIs that make it possible to perform malware analysis and memory forensics based on artifacts in the Windows GUI subsystem. This subsystem plays a part in nearly everything you do and everything you see on a Windows computer, so it is rich with evidence and was largely unexplored and undocumented from a malware and forensics perspective. There are not many tools, even for live systems, that can give you the type of visibility into this exciting realm of Windows internals that Volatility can now provide.

The topics discussed were also seen during of the Month of Volatility Plugins, including sessions, clipboard data and clipboard snooping, window stations, desktops, desktop heaps, atoms and atom tables, USER handles, GDI timers, windows, message hooks, event hooks, and screenshots.

Author/presenter: Michael Ligh (@iMHLv2)
Direct link: Malware in the Windows GUI Subsystem