Volatility

Description

A memory forensics analysis platform.

Platform	Python
Author	Volatility Foundation
License	GPLv2
URL	https://www.volatilityfoundation.org/

Usage

Options:
  -h, --help            list all available options and their default values.
                        Default values may be set in the configuration file
                        (/etc/volatilityrc)
  --conf-file=/root/.volatilityrc
                        User based configuration file
  -d, --debug           Debug volatility
  --plugins=PLUGINS     Additional plugin directories to use (colon separated)
  --info                Print information about all registered objects
  --cache-directory=/root/.cache/volatility
                        Directory where cache files are stored
  --cache               Use caching
  --tz=TZ               Sets the (Olson) timezone for displaying timestamps
                        using pytz (if installed) or tzset
  -f FILENAME, --filename=FILENAME
                        Filename to use when opening an image
  --profile=WinXPSP2x86
                        Name of the profile to load (use --info to see a list
                        of supported profiles)
  -l LOCATION, --location=LOCATION
                        A URN location from which to load an address space
  -w, --write           Enable write support
  --dtb=DTB             DTB Address
  --shift=SHIFT         Mac KASLR shift address
  --output=text         Output in this format (support is module specific, see
                        the Module Output Options below)
  --output-file=OUTPUT_FILE
                        Write output in this file
  -v, --verbose         Verbose information
  -g KDBG, --kdbg=KDBG  Specify a KDBG virtual address (Note: for 64-bit
                        Windows 8 and above this is the address of
                        KdCopyDataBlock)
  --force               Force utilization of suspect profile
  --cookie=COOKIE       Specify the address of nt!ObHeaderCookie (valid for
                        Windows 10 only)
  -k KPCR, --kpcr=KPCR  Specify a specific KPCR address

Supported Plugins

Supported Plugin Commands:
 
    amcache         Print AmCache information
    apihooks        Detect API hooks in process and kernel memory
    apihooksdeep    Detect API hooks in process and kernel memory, with ssdeep for whitelisting
    atoms           Print session and window station atom tables
    atomscan        Pool scanner for atom tables
    attributeht     Find Hacking Team implants and attempt to attribute them using a watermark.
    auditpol        Prints out the Audit Policies from HKLM\SECURITY\Policy\PolAdtEv
    autoruns        Searches the registry and memory space for applications running at system startup and maps them to running processes
    bigpools        Dump the big page pools using BigPagePoolScanner
    bioskbd         Reads the keyboard buffer from Real Mode memory
    cachedump       Dumps cached domain hashes from memory
    callbacks       Print system-wide notification routines
    chromecookies   Scans for and parses potential Chrome cookie data
    chromedownloadchains    Scans for and parses potential Chrome download chain records
    chromedownloads Scans for and parses potential Chrome download records
    chromehistory   Scans for and parses potential Chrome url history
    chromesearchterms   Scans for and parses potential Chrome keyword search terms
    chromevisits    Scans for and parses potential Chrome url visits data -- VERY SLOW, see -Q option
    clipboard       Extract the contents of the windows clipboard
    cmdline         Display process command-line arguments
    cmdscan         Extract command history by scanning for _COMMAND_HISTORY
    connections     Print list of open connections [Windows XP and 2003 Only]
    connscan        Pool scanner for tcp connections
    consoles        Extract command history by scanning for _CONSOLE_INFORMATION
    crashinfo       Dump crash-dump information
    deskscan        Poolscaner for tagDESKTOP (desktops)
    devicetree      Show device tree
    dlldump         Dump DLLs from a process address space
    dlllist         Print list of loaded dlls for each process
    driverbl        Scans memory for driver objects and compares the results with the baseline image
    driverirp       Driver IRP hook detection
    driveritem     
    drivermodule    Associate driver objects to kernel modules
    driverscan      Pool scanner for driver objects
    dumpcerts       Dump RSA private and public SSL keys
    dumpfiles       Extract memory mapped and cached files
    dumpregistry    Dumps registry files out to disk
    editbox         Dumps various data from ComCtl Edit controls (experimental: ListBox, ComboBox)
    envars          Display process environment variables
    eventhooks      Print details on windows event hooks
    evtlogs         Extract Windows Event Logs (XP/2003 only)
    fileitem       
    filescan        Pool scanner for file objects
    firefoxcookies  Scans for and parses potential Firefox cookies (cookies.sqlite moz_cookies table
    firefoxdownloads    Scans for and parses potential Firefox download records -- downloads.sqlite moz_downloads table pre FF26 only
    firefoxhistory  Scans for and parses potential Firefox url history (places.sqlite moz_places table)
    gahti           Dump the USER handle type information
    gditimers       Print installed GDI timers and callbacks
    gdt             Display Global Descriptor Table
    getservicesids  Get the names of services in the Registry and return Calculated SID
    getsids         Print the SIDs owning each process
    handles         Print list of open handles for each process
    hashdump        Dumps passwords hashes (LM/NTLM) from memory
    hibinfo         Dump hibernation file information
    hivedump        Prints out a hive
    hivelist        Print list of registry hives.
    hivescan        Pool scanner for registry hives
    hookitem       
    hpakextract     Extract physical memory from an HPAK file
    hpakinfo        Info on an HPAK file
    idt             Display Interrupt Descriptor Table
    idxparser       Scans for and parses Java IDX files
    iehistory       Reconstruct Internet Explorer cache / history
    imagecopy       Copies a physical address space out as a raw DD image
    imageinfo       Identify information for the image
    impscan         Scan for calls to imported functions
    joblinks        Print process job link information
    kdbgscan        Search for and dump potential KDBG values
    kpcrscan        Search for and dump potential KPCR values
    ldrmodules      Detect unlinked DLLs
    lsadump         Dump (decrypted) LSA secrets from the registry
    machoinfo       Dump Mach-O file format information
    malfind         Find hidden and injected code
    malfinddeep     Find hidden and injected code, whitelist with ssdeep hashes
    malprocfind     Finds malicious processes based on discrepancies from observed, normal behavior and properties
    malsysproc      Find malware hiding in plain sight as system processes
    mbrparser       Scans for and parses potential Master Boot Records (MBRs)
    memdump         Dump the addressable memory for a process
    memmap          Print the memory map
    messagehooks    List desktop and thread window message hooks
    mftparser       Scans for and parses potential MFT entries
    mimikatz        mimikatz offline
    moddump         Dump a kernel driver to an executable file sample
    modscan         Pool scanner for kernel modules
    modules         Print list of loaded modules
    multiscan       Scan for various objects at once
    mutantscan      Pool scanner for mutex objects
    ndispktscan     Extract the packets from memory
    notepad         List currently displayed notepad text
    objtypescan     Scan for Windows object type objects
    openioc_scan    Scan OpenIOC 1.1 based indicators
    openvpn         Extract OpenVPN client credentials (username, password) cached in memory.
    patcher         Patches memory based on page scans
    poolpeek        Configurable pool scanner plugin
    prefetchparser  Scans for and parses potential Prefetch files
    printkey        Print a registry key, and its subkeys and values
    privs           Display process privileges
    procdump        Dump a process to an executable file sample
    processbl       Scans memory for processes and loaded DLLs and compares the results with the baseline
    pslist          Print all running processes by following the EPROCESS lists
    psscan          Pool scanner for process objects
    pstotal         Combination of pslist,psscan & pstree --output=dot gives graphical representation
    pstree          Print process list as a tree
    psxview         Find hidden processes with various process listings
    qemuinfo        Dump Qemu information
    raw2dmp         Converts a physical memory sample to a windbg crash dump
    registryitem   
    rsakey          Extract base64/PEM encoded private RSA keys from physical memory.
    schtasks        Scans for and parses potential Scheduled Task (.JOB) files
    screenshot      Save a pseudo-screenshot based on GDI windows
    servicebl       Scans memory for service objects and compares the results with the baseline image
    servicediff     List Windows services (ala Plugx)
    serviceitem    
    sessions        List details on _MM_SESSION_SPACE (user logon sessions)
    shellbags       Prints ShellBags info
    shimcache       Parses the Application Compatibility Shim Cache registry key
    shimcachemem    Parses the Application Compatibility Shim Cache stored in kernel memory
    shutdowntime    Print ShutdownTime of machine from registry
    sockets         Print list of open sockets
    sockscan        Pool scanner for tcp socket objects
    ssdeepscan      Scan process or kernel memory with SSDeep signatures
    ssdt            Display SSDT entries
    strings         Match physical offsets to virtual addresses (may take a while, VERY verbose)
    svcscan         Scan for Windows services
    symlinkscan     Pool scanner for symlink objects
    thrdscan        Pool scanner for thread objects
    threads         Investigate _ETHREAD and _KTHREADs
    timeliner       Creates a timeline from various artifacts in memory
    timers          Print kernel timers and associated module DPCs
    truecryptmaster Recover TrueCrypt 7.1a Master Keys
    truecryptpassphrase TrueCrypt Cached Passphrase Finder
    truecryptsummary    TrueCrypt Summary
    trustrecords    Extract MS Office TrustRecords from the Registry
    uninstallinfo   Extract installed software info from Uninstall registry key
    unloadedmodules Print list of unloaded modules
    userassist      Print userassist registry keys and information
    userhandles     Dump the USER handle tables
    usnparser       Scans for and parses USN journal records
    vaddump         Dumps out the vad sections to a file
    vadinfo         Dump the VAD info
    vadtree         Walk the VAD tree and display in tree format
    vadwalk         Walk the VAD tree
    vboxinfo        Dump virtualbox information
    verinfo         Prints out the version information from PE images
    vmwareinfo      Dump VMware VMSS/VMSN information
    volshell        Shell in the memory image
    windows         Print Desktop Windows (verbose details)
    wintree         Print Z-Order Desktop Windows Tree
    wndscan         Pool scanner for window stations
    yarascan        Scan process or kernel memory with Yara signatures

Examples

Find the correct profile to use

This command will scan the memory image and attempt to guess the correct profile to use:

root@siftworkstation:~# vol.py -f ./win7-32-nromanoff-memory-raw.001 imageinfo
Volatility Foundation Volatility Framework 2.5
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP0x86, Win7SP1x86
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/sansforensics/netwars/win7-32-nromanoff-memory/win7-32-nromanoff-memory-raw.001)
                      PAE type : PAE
                           DTB : 0x185000L
                          KDBG : 0x82d29c28L
          Number of Processors : 1
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0x82d2ac00L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2012-04-06 20:52:46 UTC+0000
     Image local date and time : 2012-04-06 16:52:46 -0400

vol.py -f <image> –profile=<profile> pslist

This command will scan memory for currently running processes:

root@siftworkstation:~# vol.py -f ./win7-32-nromanoff-memory-raw.001 --profile=Win7SP0x86 pslist
Volatility Foundation Volatility Framework 2.5
Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit                         
---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0x85c50958 System                    4      0    105      532 ------      0 2012-04-04 11:47:29 UTC+0000                                
0x86ecaa70 smss.exe                280      4      3       32 ------      0 2012-04-04 11:47:29 UTC+0000                                
0x86cfa540 csrss.exe               412    404      9      756      0      0 2012-04-04 11:47:41 UTC+0000                                
0x87d85d40 wininit.exe             464    404      3       74      0      0 2012-04-04 11:47:44 UTC+0000                                
0x86e7f030 csrss.exe               472    456      9       75      1      0 2012-04-04 11:47:44 UTC+0000                                
0x87d8fd40 winlogon.exe            520    456      3       91      1      0 2012-04-04 11:47:44 UTC+0000                                
0x87f68030 services.exe            564    464      7      243      0      0 2012-04-04 11:47:45 UTC+0000                                
0x87f79600 lsass.exe               592    464      8      888      0      0 2012-04-04 11:47:46 UTC+0000                                
0x87f8c030 lsm.exe                 600    464     10      248      0      0 2012-04-04 11:47:46 UTC+0000                                
0x87fc5590 svchost.exe             704    564     11      358      0      0 2012-04-04 11:47:48 UTC+0000                                
0x87fee6d0 svchost.exe             780    564      6      277      0      0 2012-04-04 11:47:51 UTC+0000                                
0x88000d40 svchost.exe             820    564     18      469      0      0 2012-04-04 11:47:51 UTC+0000                                
0x8800e178 LogonUI.exe             880    520      7      197      1      0 2012-04-04 11:47:51 UTC+0000                                
0x880308e8 svchost.exe             920    564     18      495      0      0 2012-04-04 11:47:51 UTC+0000                                
0x88047a58 svchost.exe             944    564     31     1213      0      0 2012-04-04 11:47:52 UTC+0000                                
0x880462b8 svchost.exe            1032    564     17      394      0      0 2012-04-04 11:47:52 UTC+0000                                
0x880a0758 svchost.exe            1184    564     20      634      0      0 2012-04-04 11:48:00 UTC+0000                                
0x88070d40 spoolsv.exe            1308    564     13      328      0      0 2012-04-04 11:48:03 UTC+0000                                
0x880e7030 svchost.exe            1344    564     17      295      0      0 2012-04-04 11:48:03 UTC+0000                                
0x88120658 armsvc.exe             1456    564      4       61      0      0 2012-04-04 11:48:04 UTC+0000                                
0x88145b38 FireSvc.exe            1516    564     22      355      0      0 2012-04-04 11:48:05 UTC+0000                                
0x881b8030 McSACore.exe           1604    564     11      199      0      0 2012-04-04 11:48:08 UTC+0000                                
0x881b4900 FireTray.exe           1624   1516      0 --------      0      0 2012-04-04 11:48:09 UTC+0000   2012-04-04 11:48:10 UTC+0000 
0x881dd770 FrameworkServi         1740    564     31      426      0      0 2012-04-04 11:48:10 UTC+0000                                
0x8820bd40 VsTskMgr.exe           1796    564     21      365      0      0 2012-04-04 11:48:11 UTC+0000                                
0x88227358 mfevtps.exe            1824    564      5      171      0      0 2012-04-04 11:48:12 UTC+0000                                
0x8821a660 mfeann.exe             1872   1796     14      181      0      0 2012-04-04 11:48:12 UTC+0000                                
0x88220d40 conhost.exe            1880    412      2       30      0      0 2012-04-04 11:48:12 UTC+0000                                
0x88235cf8 VMwareService.         1964    564      7      192      0      0 2012-04-04 11:48:14 UTC+0000                                
0x8824cd40 naPrdMgr.exe            200    704      8      252      0      0 2012-04-04 11:48:15 UTC+0000                                
0x88263648 mcshield.exe            332    564     28      459      0      0 2012-04-04 11:48:15 UTC+0000                                
0x8827d9f0 mfefire.exe             456    564      7      108      0      0 2012-04-04 11:48:23 UTC+0000                                
0x88295900 VMUpgradeHelpe          888    564      4       87      0      0 2012-04-04 11:48:24 UTC+0000                                
0x8842a4b8 svchost.exe            2980    564     12      198      0      0 2012-04-04 11:50:42 UTC+0000                                
0x885561f8 SearchIndexer.         3092    564     14      992      0      0 2012-04-04 11:50:46 UTC+0000                                
0x862709a0 csrss.exe              2132   3112      9      271      2      0 2012-04-04 14:45:30 UTC+0000                                
0x8617bd40 winlogon.exe           3836   3112      3      112      2      0 2012-04-04 14:45:30 UTC+0000                                
0x85dbcb48 taskhost.exe           1108    564      9      290      2      0 2012-04-04 14:45:43 UTC+0000                                
0x861bb8f0 rdpclip.exe            2408   1184      4       88      2      0 2012-04-04 14:45:43 UTC+0000                                
0x8625b030 dwm.exe                3924    920      3       67      2      0 2012-04-04 14:45:44 UTC+0000                                
0x8622b4b8 explorer.exe            296   2392     22      853      2      0 2012-04-04 14:45:45 UTC+0000                                
0x861d4520 VMwareTray.exe         3780    296      5       65      2      0 2012-04-04 14:45:46 UTC+0000                                
0x861b6518 VMwareUser.exe         3804    296      3       77      2      0 2012-04-04 14:45:46 UTC+0000                                
0x86272d40 UdaterUI.exe           2944   1740      6      109      2      0 2012-04-04 14:49:35 UTC+0000                                
0x863c8030 McTray.exe             2864   2944     23      341      2      0 2012-04-04 14:49:35 UTC+0000                                
0x85f98728 a.exe                  3264   3440      0 --------      2      0 2012-04-04 14:57:52 UTC+0000   2012-04-04 18:40:58 UTC+0000 
0x85e24030 OSPPSVC.EXE            4040    564      3      134      0      0 2012-04-04 15:42:01 UTC+0000                                
0x861d93a0 cmd.exe                3472   3264      0 --------      2      0 2012-04-04 15:47:47 UTC+0000   2012-04-04 15:49:07 UTC+0000 
0x862bfa40 spinlock.exe           3796   3472      0 --------      2      0 2012-04-04 15:48:18 UTC+0000   2012-04-04 18:43:25 UTC+0000 
0x8654c4a8 spinlock.exe           1208   3796      0 --------      2      0 2012-04-04 15:48:18 UTC+0000   2012-04-04 18:43:25 UTC+0000 
0x860f2578 cmd.exe                 208   1208      1       31      2      0 2012-04-04 18:43:24 UTC+0000                                
0x86136a60 conhost.exe            2840   2132      2       28      2      0 2012-04-04 18:43:25 UTC+0000                                
0x864e57c8 PSEXESVC.EXE           2100    564      6      104      0      0 2012-04-04 18:52:11 UTC+0000                                
0x862a4d40 svchost.exe            3612   2100      0 --------      0      0 2012-04-04 18:52:11 UTC+0000   2012-04-05 13:25:07 UTC+0000 
0x862bb290 spinlock.exe           2956   2100      1       26      0      0 2012-04-04 18:54:51 UTC+0000                                
0x86383c18 spinlock.exe           1328   2956      2      128      0      0 2012-04-04 18:54:51 UTC+0000                                
0x86d2b578 a.exe                  5008   4212      0 --------      0      0 2012-04-06 13:19:34 UTC+0000   2012-04-06 16:58:26 UTC+0000 
0x862f9a58 cmd.exe                5192   5008      1       28      0      0 2012-04-06 14:03:11 UTC+0000                                
0x86a1c8b8 conhost.exe            3408    412      2       31      0      0 2012-04-06 14:03:11 UTC+0000                                
0x8649d880 svchost.exe            6404   2100      8      256      0      0 2012-04-06 19:22:20 UTC+0000                                
0x86eeb430 f-response-ent         7776    564      8       75      0      0 2012-04-06 20:34:42 UTC+0000                                
0x85dde298 svchost.exe            5176    564      5       90      0      0 2012-04-06 20:34:44 UTC+0000

vol.py -f <image> –profile=<profile> netscan

This command will scan memory for net connections and their associated processes:

root@siftworkstation:~# vol.py -f ./win7-32-nromanoff-memory-raw.001 --profile=Win7SP0x86 netscan
Volatility Foundation Volatility Framework 2.5
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x4fb90e0          UDPv4    0.0.0.0:0                      *:*                                   456      mfefire.exe    2012-04-04 11:48:37 UTC+0000
0x4fb90e0          UDPv6    :::0                           *:*                                   456      mfefire.exe    2012-04-04 11:48:37 UTC+0000
0x7d8e1b20         UDPv4    0.0.0.0:8082                   *:*                                   1740     FrameworkServi 2012-04-04 11:48:26 UTC+0000
0x7d8e2d38         UDPv4    0.0.0.0:8082                   *:*                                   1740     FrameworkServi 2012-04-04 11:48:26 UTC+0000
0x7d8e2d38         UDPv6    :::8082                        *:*                                   1740     FrameworkServi 2012-04-04 11:48:26 UTC+0000
0x7d931120         UDPv4    0.0.0.0:0                      *:*                                   456      mfefire.exe    2012-04-04 11:48:37 UTC+0000
0x7d946818         UDPv4    0.0.0.0:0                      *:*                                   1032     svchost.exe    2012-04-04 11:48:38 UTC+0000
0x7d947330         UDPv4    0.0.0.0:0                      *:*                                   1032     svchost.exe    2012-04-04 11:48:38 UTC+0000
0x7d947330         UDPv6    :::0                           *:*                                   1032     svchost.exe    2012-04-04 11:48:38 UTC+0000
0x7d984e20         UDPv4    0.0.0.0:123                    *:*                                   1032     svchost.exe    2012-04-04 11:48:39 UTC+0000
0x7d985bb0         UDPv4    0.0.0.0:123                    *:*                                   1032     svchost.exe    2012-04-04 11:48:39 UTC+0000
0x7d985bb0         UDPv6    :::123                         *:*                                   1032     svchost.exe    2012-04-04 11:48:39 UTC+0000
0x7d8b0b50         TCPv4    0.0.0.0:445                    0.0.0.0:0            LISTENING        4        System        
0x7d8b0b50         TCPv6    :::445                         :::0                 LISTENING        4        System        
0x7d8df2a8         TCPv4    0.0.0.0:8081                   0.0.0.0:0            LISTENING        1740     FrameworkServi
0x7d8e1ea8         TCPv4    0.0.0.0:8081                   0.0.0.0:0            LISTENING        1740     FrameworkServi
0x7d8e1ea8         TCPv6    :::8081                        :::0                 LISTENING        1740     FrameworkServi
0x7d93ca70         TCPv4    0.0.0.0:49186                  0.0.0.0:0            LISTENING        564      services.exe  
0x7d93ca70         TCPv6    :::49186                       :::0                 LISTENING        564      services.exe  
0x7d969ec0         TCPv4    0.0.0.0:3389                   0.0.0.0:0            LISTENING        1184     svchost.exe   
0x7d96e308         TCPv4    0.0.0.0:3389                   0.0.0.0:0            LISTENING        1184     svchost.exe   
0x7d96e308         TCPv6    :::3389                        :::0                 LISTENING        1184     svchost.exe   
0x7dab56c0         UDPv4    0.0.0.0:5355                   *:*                                   1184     svchost.exe    2012-04-04 11:48:00 UTC+0000
0x7dab6208         UDPv4    0.0.0.0:0                      *:*                                   1184     svchost.exe    2012-04-04 11:48:00 UTC+0000
0x7dab6208         UDPv6    :::0                           *:*                                   1184     svchost.exe    2012-04-04 11:48:00 UTC+0000
0x7daf8960         UDPv4    0.0.0.0:0                      *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7daf8960         UDPv6    :::0                           *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db136a0         UDPv4    127.0.0.1:55829                *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db17770         UDPv4    127.0.0.1:55827                *:*                                   1184     svchost.exe    2012-04-04 11:48:04 UTC+0000
0x7db24ac8         UDPv4    0.0.0.0:0                      *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db24ac8         UDPv6    :::0                           *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db2a008         UDPv4    0.0.0.0:0                      *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db2a008         UDPv6    :::0                           *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db2af50         UDPv4    0.0.0.0:0                      *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db31320         UDPv4    0.0.0.0:0                      *:*                                   592      lsass.exe      2012-04-04 11:48:04 UTC+0000
0x7db36008         UDPv4    127.0.0.1:55832                *:*                                   944      svchost.exe    2012-04-04 11:48:04 UTC+0000
0x7da02898         TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        464      wininit.exe   
0x7da03298         TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        780      svchost.exe   
0x7da03298         TCPv6    :::135                         :::0                 LISTENING        780      svchost.exe   
0x7da223e8         TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        820      svchost.exe   
0x7da25648         TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        820      svchost.exe   
0x7da25648         TCPv6    :::49153                       :::0                 LISTENING        820      svchost.exe   
0x7da96700         TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        592      lsass.exe     
0x7da96700         TCPv6    :::49154                       :::0                 LISTENING        592      lsass.exe     
0x7da96de8         TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        592      lsass.exe     
0x7dad06f0         TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        944      svchost.exe   
0x7dad2430         TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        944      svchost.exe   
0x7dad2430         TCPv6    :::49155                       :::0                 LISTENING        944      svchost.exe   
0x7ddf35a0         TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        780      svchost.exe   
0x7ddfb440         TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        464      wininit.exe   
0x7ddfb440         TCPv6    :::49152                       :::0                 LISTENING        464      wininit.exe   
0x7db4cc10         TCPv4    -:62342                        -:80                 CLOSED           1184     svchost.exe   
0x7ec1f2b8         UDPv4    10.3.58.5:138                  *:*                                   4        System         2012-04-04 11:47:39 UTC+0000
0x7eccb7c8         UDPv4    10.3.58.5:137                  *:*                                   4        System         2012-04-04 11:47:39 UTC+0000
0x7ed807e0         TCPv4    0.0.0.0:49186                  0.0.0.0:0            LISTENING        564      services.exe  
0x7ed974b0         TCPv4    10.3.58.5:139                  0.0.0.0:0            LISTENING        4        System        
0x7f463770         UDPv4    127.0.0.1:1900                 *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7f476008         UDPv4    127.0.0.1:49724                *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7f476b40         UDPv6    ::1:49722                      *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7f47b880         UDPv4    10.3.58.5:1900                 *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7f4e5548         UDPv4    10.3.58.5:49723                *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7f5b5248         UDPv4    10.3.58.5:55261                *:*                                   7816     Skype.exe      2012-04-06 19:44:03 UTC+0000
0x7eec5a58         TCPv4    -:62344                        -:443                CLOSED           7816     Skype.exe     
0x7ef2b988         TCPv4    10.3.58.5:62619                10.3.58.4:445        CLOSED           4        System        
0x7f451df8         TCPv4    -:62331                        224.0.0.252:443      CLOSED           7816     Skype.exe     
0x7f60adf8         TCPv4    127.0.0.1:5678                 127.0.0.1:62608      CLOSED           6404     svchost.exe   
0x7f632008         TCPv4    -:62336                        69.171.229.13:443    CLOSED           7816     Skype.exe     
0x7f67a448         TCPv4    -:139                          12.190.135.235:2264  CLOSED           4        System        
0x7f693140         TCPv4    10.3.58.5:62567                10.3.58.255:80       CLOSED           6404     svchost.exe   
0x7f6fb448         TCPv4    10.3.58.5:62617                10.3.58.4:445        CLOSED           4        System        
0x7f7492f0         TCPv4    10.3.58.5:62294                10.3.58.9:135        CLOSED           4172     taskhost.exe  
0x7f760a08         TCPv4    10.3.58.5:62295                10.3.58.9:49156      CLOSED           4172     taskhost.exe  
0x7f899400         UDPv4    127.0.0.1:49290                *:*                                   1108     taskhost.exe   2012-04-04 14:45:46 UTC+0000
0x7f940568         UDPv6    ::1:1900                       *:*                                   2980     svchost.exe    2012-04-04 19:40:36 UTC+0000
0x7fd46238         UDPv4    0.0.0.0:0                      *:*                                   5176     svchost.exe    2012-04-06 20:34:44 UTC+0000
0x7fd9f688         UDPv4    0.0.0.0:0                      *:*                                   5176     svchost.exe    2012-04-06 20:34:44 UTC+0000
0x7fd9f688         UDPv6    :::0                           *:*                                   5176     svchost.exe    2012-04-06 20:34:44 UTC+0000
0x7f947098         TCPv4    0.0.0.0:3260                   0.0.0.0:0            LISTENING        7776     f-response-ent
0x7ff175f8         TCPv4    127.0.0.1:5678                 0.0.0.0:0            LISTENING        6404     svchost.exe   
0x7f837580         TCPv4    10.3.58.5:49805                10.3.58.9:445        ESTABLISHED      4        System        
0x7f89a1d0         TCPv4    10.3.58.5:50817                199.73.28.114:443    CLOSED           1328     spinlock.exe  
0x7f8c8008         TCPv4    10.3.58.5:62421                10.3.58.9:135        CLOSED           592      lsass.exe     
0x7f8f8008         TCPv4    10.3.58.5:62333                10.3.16.5:443        CLOSED           7816     Skype.exe     
0x7fa47008         TCPv4    -:62334                        184.51.253.195:443   CLOSED           7816     Skype.exe     
0x7fa559f8         TCPv4    -:62335                        184.51.255.240:443   CLOSED           7816     Skype.exe     
0x7fc6e318         TCPv4    10.3.58.5:3260                 10.3.16.5:48351      ESTABLISHED      7776     f-response-ent
0x7fe9b278         TCPv4    10.3.58.5:62380                10.3.58.9:445        CLOSED           4        System

vol.py imagecopy -f hiberfil.sys -O hiber.raw

This command will uncompress a hibernation file into raw memory dump:

root@siftworkstation:~# vol.py imagecopy -f /mnt/romanoff/hiberfil.sys -O hiber.raw
Volatility Foundation Volatility Framework 2.5
Writing data (5.00 MB chunks): |....................................................................................................................................................................................................................................................................................................................|

Blog Posts

Rekall

Description

A python memory analysis framework that can be difficult to install and setup.

Platform	Python
Author	Rekall Forensics
License	GPLv2
URL	http://www.rekall-forensic.com/

Usage

usage: rekal [-p PROFILE] [-v] [-q] [--debug] [--output_style {concise,full}]
             [--logging_level {DEBUG,INFO,WARNING,ERROR,CRITICAL}]
             [--pager PAGER] [--paging_limit PAGING_LIMIT]
             [--colors {auto,yes,no}] [-F {text,json,wide,test,data}]
             [--plugin [PLUGIN [PLUGIN ...]]] [-h]
             [--cache {file,memory,timed}]
             [--repository_path [REPOSITORY_PATH [REPOSITORY_PATH ...]]]
             [-f FILENAME] [--buffer_size BUFFER_SIZE] [--output OUTPUT]
             [--max_collector_cost MAX_COLLECTOR_COST] [--home HOME]
             [--logging_format LOGGING_FORMAT]
             [--performance {normal,fast,thorough}] [--dtb DTB]
             [-o FILE_OFFSET] [--ept EPT [EPT ...]] [--timezone TIMEZONE]
             [--cache_dir CACHE_DIR]
             [--name_resolution_strategies [{Module,Symbol,Export} [{Module,Symbol,Export} ...]]]
             [--autodetect_build_local_tracked [AUTODETECT_BUILD_LOCAL_TRACKED [AUTODETECT_BUILD_LOCAL_TRACKED ...]]]
             [--pagefile [PAGEFILE [PAGEFILE ...]]]
             [--autodetect {linux_index,nt_index,osx,pe,windows_kernel_file,rsds,ntfs,linux} [{linux_index,nt_index,osx,pe,windows_kernel_file,rsds,ntfs,linux} ...]]
             [--autodetect_threshold AUTODETECT_THRESHOLD]
             [--autodetect_build_local {full,basic,none}]
             [--autodetect_scan_length AUTODETECT_SCAN_LENGTH] [--live]
             [--version] [-]

Examples

rekal -f <image> pslist

The following output is from running the pslist plugin inside rekall:

root@siftworkstation:~# rekal -f win7-32-nromanoff-memory-raw.001 pslist
2021-07-25 21:43:58,349:WARNING:rekall.1:Inventory for repository "http://profiles.rekall-forensic.com" seems malformed. Are you behind a captive portal or proxy? If this is a custom repository, did you forget to create an inventory? You must use the tools/profiles/build_profile_repo.py tool with the --inventory flag.
2021-07-25 21:43:58,349:WARNING:rekall.1:Repository http://profiles.rekall-forensic.com will be disabled.
2021-07-25 21:43:58,422:WARNING:rekall.1:Unable to parse profile section $CONSTANT_TYPES
2021-07-25 21:43:58,423:WARNING:rekall.1:Unable to parse profile section $CONSTANT_TYPES
_EPROCESS          Name          PID   PPID   Thds    Hnds    Sess  Wow64           Start                     Exit         
---------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------
0x85c50958 System                   4      0    105      532      - False  2012-04-04 11:47:29Z     -                      
0x8824cd40 naPrdMgr.exe           200    704      8      252      0 False  2012-04-04 11:48:15Z     -                      
0x860f2578 cmd.exe                208   1208      1       31      2 False  2012-04-04 18:43:24Z     -                      
0x86ecaa70 smss.exe               280      4      3       32      - False  2012-04-04 11:47:29Z     -                      
0x8622b4b8 explorer.exe           296   2392     22      853      2 False  2012-04-04 14:45:45Z     -                      
0x88263648 mcshield.exe           332    564     28      459      0 False  2012-04-04 11:48:15Z     -                      
0x86cfa540 csrss.exe              412    404      9      756      0 False  2012-04-04 11:47:41Z     -                      
0x8827d9f0 mfefire.exe            456    564      7      108      0 False  2012-04-04 11:48:23Z     -                      
0x87d85d40 wininit.exe            464    404      3       74      0 False  2012-04-04 11:47:44Z     -                      
0x86e7f030 csrss.exe              472    456      9       75      1 False  2012-04-04 11:47:44Z     -                      
0x87d8fd40 winlogon.exe           520    456      3       91      1 False  2012-04-04 11:47:44Z     -                      
0x87f68030 services.exe           564    464      7      243      0 False  2012-04-04 11:47:45Z     -                      
0x87f79600 lsass.exe              592    464      8      888      0 False  2012-04-04 11:47:46Z     -                      
0x87f8c030 lsm.exe                600    464     10      248      0 False  2012-04-04 11:47:46Z     -                      
0x87fc5590 svchost.exe            704    564     11      358      0 False  2012-04-04 11:47:48Z     -                      
0x87fee6d0 svchost.exe            780    564      6      277      0 False  2012-04-04 11:47:51Z     -                      
0x88000d40 svchost.exe            820    564     18      469      0 False  2012-04-04 11:47:51Z     -                      
0x8800e178 LogonUI.exe            880    520      7      197      1 False  2012-04-04 11:47:51Z     -                      
0x88295900 VMUpgradeHelpe         888    564      4       87      0 False  2012-04-04 11:48:24Z     -                      
0x880308e8 svchost.exe            920    564     18      495      0 False  2012-04-04 11:47:51Z     -                      
0x88047a58 svchost.exe            944    564     31     1213      0 False  2012-04-04 11:47:52Z     -                      
0x880462b8 svchost.exe           1032    564     17      394      0 False  2012-04-04 11:47:52Z     -                      
0x85dbcb48 taskhost.exe          1108    564      9      290      2 False  2012-04-04 14:45:43Z     -                      
0x880a0758 svchost.exe           1184    564     20      634      0 False  2012-04-04 11:48:00Z     -                      
0x8654c4a8 spinlock.exe          1208   3796      0        -      2 False  2012-04-04 15:48:18Z     2012-04-04 18:43:25Z   
0x88070d40 spoolsv.exe           1308    564     13      328      0 False  2012-04-04 11:48:03Z     -                      
0x86383c18 spinlock.exe          1328   2956      2      128      0 False  2012-04-04 18:54:51Z     -                      
0x880e7030 svchost.exe           1344    564     17      295      0 False  2012-04-04 11:48:03Z     -                      
0x88120658 armsvc.exe            1456    564      4       61      0 False  2012-04-04 11:48:04Z     -                      
0x88145b38 FireSvc.exe           1516    564     22      355      0 False  2012-04-04 11:48:05Z     -                      
0x881b8030 McSACore.exe          1604    564     11      199      0 False  2012-04-04 11:48:08Z     -                      
0x881b4900 FireTray.exe          1624   1516      0        -      0 False  2012-04-04 11:48:09Z     2012-04-04 11:48:10Z   
0x881dd770 FrameworkServi        1740    564     31      426      0 False  2012-04-04 11:48:10Z     -                      
0x8820bd40 VsTskMgr.exe          1796    564     21      365      0 False  2012-04-04 11:48:11Z     -                      
0x88227358 mfevtps.exe           1824    564      5      171      0 False  2012-04-04 11:48:12Z     -                      
0x8821a660 mfeann.exe            1872   1796     14      181      0 False  2012-04-04 11:48:12Z     -                      
0x88220d40 conhost.exe           1880    412      2       30      0 False  2012-04-04 11:48:12Z     -                      
0x88235cf8 VMwareService.        1964    564      7      192      0 False  2012-04-04 11:48:14Z     -                      
0x864e57c8 PSEXESVC.EXE          2100    564      6      104      0 False  2012-04-04 18:52:11Z     -                      
0x862709a0 csrss.exe             2132   3112      9      271      2 False  2012-04-04 14:45:30Z     -                      
0x861bb8f0 rdpclip.exe           2408   1184      4       88      2 False  2012-04-04 14:45:43Z     -                      
0x86136a60 conhost.exe           2840   2132      2       28      2 False  2012-04-04 18:43:25Z     -                      
0x863c8030 McTray.exe            2864   2944     23      341      2 False  2012-04-04 14:49:35Z     -                      
0x86272d40 UdaterUI.exe          2944   1740      6      109      2 False  2012-04-04 14:49:35Z     -                      
0x862bb290 spinlock.exe          2956   2100      1       26      0 False  2012-04-04 18:54:51Z     -                      
0x8842a4b8 svchost.exe           2980    564     12      198      0 False  2012-04-04 11:50:42Z     -                      
0x885561f8 SearchIndexer.        3092    564     14      992      0 False  2012-04-04 11:50:46Z     -                      
0x85f98728 a.exe                 3264   3440      0        -      2 False  2012-04-04 14:57:52Z     2012-04-04 18:40:58Z   
0x86a1c8b8 conhost.exe           3408    412      2       31      0 False  2012-04-06 14:03:11Z     -                      
0x861d93a0 cmd.exe               3472   3264      0        -      2 False  2012-04-04 15:47:47Z     2012-04-04 15:49:07Z   
0x862a4d40 svchost.exe           3612   2100      0        -      0 False  2012-04-04 18:52:11Z     2012-04-05 13:25:07Z   
0x861d4520 VMwareTray.exe        3780    296      5       65      2 False  2012-04-04 14:45:46Z     -                      
0x862bfa40 spinlock.exe          3796   3472      0        -      2 False  2012-04-04 15:48:18Z     2012-04-04 18:43:25Z   
0x861b6518 VMwareUser.exe        3804    296      3       77      2 False  2012-04-04 14:45:46Z     -                      
0x8617bd40 winlogon.exe          3836   3112      3      112      2 False  2012-04-04 14:45:30Z     -                      
0x8625b030 dwm.exe               3924    920      3       67      2 False  2012-04-04 14:45:44Z     -                      
0x85e24030 OSPPSVC.EXE           4040    564      3      134      0 False  2012-04-04 15:42:01Z     -                      
0x86d2b578 a.exe                 5008   4212      0        -      0 False  2012-04-06 13:19:34Z     2012-04-06 16:58:26Z   
0x85dde298 svchost.exe           5176    564      5       90      0 False  2012-04-06 20:34:44Z     -                      
0x862f9a58 cmd.exe               5192   5008      1       28      0 False  2012-04-06 14:03:11Z     -                      
0x8649d880 svchost.exe           6404   2100      8      256      0 False  2012-04-06 19:22:20Z     -                      
0x86eeb430 f-response-ent        7776    564      8       75      0 False  2012-04-06 20:34:42Z     -

rekal -f <image> messagehooks

This command is useful for identifying keyloggers:

root@siftworkstation:~# rekal -f ./Post_Malware.raw messagehooks
2021-08-05 01:11:02,745:WARNING:rekall.1:Inventory for repository "http://profiles.rekall-forensic.com" seems malformed. Are you behind a captive portal or proxy? If this is a custom repository, did you forget to create an inventory? You must use the tools/profiles/build_profile_repo.py tool with the --inventory flag.
2021-08-05 01:11:02,746:WARNING:rekall.1:Repository http://profiles.rekall-forensic.com will be disabled.
  tagHOOK(V)   Sess             Owner                          Thread                 Filter        Flags       Function    Module
-------------- ---- ------------------------------ ------------------------------ --------------- ---------- -------------- ------
0xf900c06011d0 0    wininit.exe (388)              <any>                          WH_CALLWNDPROC                     0x12d8 C:\Windows\system32\wls0wndh.dll
0xf900c0620ce0 1    SysNative.exe (2676)           <any>                          WH_KEYBOARD_LL                   0xf013c0 sysnative+0x13c0
0xf900c06254f0 1    conhost.exe (352)              2016 (conhost.exe 352)         WH_MSGFILTER                   0xff350ed0 conhost!DialogHookProc

Blog Posts

analyzeMFT.py

Description

This tool is designed to fully parse the MFT file from an NTFS filesystem
and present the results as accurately as possible in multiple formats.

Platform	Python
Author	David Kovar
License	Common Public License 1.0
URL	https://github.com/dkovar/analyzeMFT

Usage

Usage: analyzeMFT.py [options]
 
Options:
  -h, --help            show this help message and exit
  -v, --version         report version and exit
  -f FILE, --file=FILE  read MFT from FILE
  -o FILE, --output=FILE
                        write results to FILE
  -a, --anomaly         turn on anomaly detection
  -e, --excel           print date/time in Excel friendly format
  -b FILE, --bodyfile=FILE
                        write MAC information to bodyfile
  --bodystd             Use STD_INFO timestamps for body file rather than FN
                        timestamps
  --bodyfull            Use full path name + filename rather than just
                        filename
  -c FILE, --csvtimefile=FILE
                        write CSV format timeline file
  -l, --localtz         report times using local timezone
  -d, --debug           turn on debugging output
  -s, --saveinmemory    Save a copy of the decoded MFT in memory. Do not use
                        for very large MFTs
  -p, --progress        Show systematic progress reports.

Examples

Blog Posts

secretsdump.py

Description

Performs various techniques to dump hashes from the remote machine without executing any agent there. For SAM and LSA Secrets (including cached creds) we try to read as much as we can from the registry and then we save the hives in the target system (%SYSTEMROOT%\\Temp dir) and read the rest of the data from there.

Platform	Python
Author	Alberto Solino
License	Modified Apache License 1.1
URL	secretsdump.py

Usage

Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation
 
usage: secretsdump.py [-h] [-ts] [-debug] [-system SYSTEM] [-bootkey BOOTKEY]
                      [-security SECURITY] [-sam SAM] [-ntds NTDS]
                      [-resumefile RESUMEFILE] [-outputfile OUTPUTFILE]
                      [-use-vss] [-exec-method [{smbexec,wmiexec,mmcexec}]]
                      [-just-dc-user USERNAME] [-just-dc] [-just-dc-ntlm]
                      [-pwd-last-set] [-user-status] [-history]
                      [-hashes LMHASH:NTHASH] [-no-pass] [-k]
                      [-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address]
                      [-target-ip ip address]
                      target
 
Performs various techniques to dump secrets from the remote machine without
executing any agent there.
 
positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
                        or LOCAL (if you want to parse local files)
 
optional arguments:
  -h, --help            show this help message and exit
  -ts                   Adds timestamp to every logging output
  -debug                Turn DEBUG output ON
  -system SYSTEM        SYSTEM hive to parse
  -bootkey BOOTKEY      bootkey for SYSTEM hive
  -security SECURITY    SECURITY hive to parse
  -sam SAM              SAM hive to parse
  -ntds NTDS            NTDS.DIT file to parse
  -resumefile RESUMEFILE
                        resume file name to resume NTDS.DIT session dump (only
                        available to DRSUAPI approach). This file will also be
                        used to keep updating the session's state
  -outputfile OUTPUTFILE
                        base output filename. Extensions will be added for
                        sam, secrets, cached and ntds
  -use-vss              Use the VSS method insead of default DRSUAPI
  -exec-method [{smbexec,wmiexec,mmcexec}]
                        Remote exec method to use at target (only when using
                        -use-vss). Default: smbexec
 
display options:
  -just-dc-user USERNAME
                        Extract only NTDS.DIT data for the user specified.
                        Only available for DRSUAPI approach. Implies also
                        -just-dc switch
  -just-dc              Extract only NTDS.DIT data (NTLM hashes and Kerberos
                        keys)
  -just-dc-ntlm         Extract only NTDS.DIT data (NTLM hashes only)
  -pwd-last-set         Shows pwdLastSet attribute for each NTDS.DIT account.
                        Doesn't apply to -outputfile data
  -user-status          Display whether or not the user is disabled
  -history              Dump password history, and LSA secrets OldVal
 
authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from
                        ccache file (KRB5CCNAME) based on target parameters.
                        If valid credentials cannot be found, it will use the
                        ones specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256
                        bits)
  -keytab KEYTAB        Read keys for SPN from keytab file
 
connection:
  -dc-ip ip address     IP Address of the domain controller. If ommited it use
                        the domain part (FQDN) specified in the target
                        parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will
                        use whatever was specified as target. This is useful
                        when target is the NetBIOS name and you cannot resolve
                        it

Examples

secretsdump.py -ntds ./ntds.dit -system ./system -outputfile /tmp/hashes.txt LOCAL

This will dump the hashes from a saved copy of ntds.dit using the encryption key in a saved copy of the SYSTEM hive.

Blog Posts

translate.py

Description

Translate bytes according to a Python expression.

Platform	N/A – Python
Author	Didier Stevens
License	Free / Public Domain
URL	https://blog.didierstevens.com/

Usage

Usage: translate.py [options] [file-in] [file-out] command [script]
 
Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -o OUTPUT, --output=OUTPUT
                        Output file (default is stdout)
  -s SCRIPT, --script=SCRIPT
                        Script with definitions to include
  -f, --fullread        Full read of the file
  -r REGEX, --regex=REGEX
                        Regex to search input file for and apply function to
  -R FILTERREGEX, --filterregex=FILTERREGEX
                        Regex to filter input file for and apply function to
  -m, --man             print manual

Examples

translate.py encoded.raw decoded.txt ‘byte ^ 0x5b’

XORs encoded.raw with the key 0x5b. Hex ASCII can be encoded as raw bytes by using the command “xxd -r -p encoded.hex > encoded.raw”.

translate.py -o svchost.exe.dec svchost.exe ‘byte ^ 0x10’

“byte” is the current byte in the file, ‘byte ^ 0x10’ does an XOR 0x10
Extra functions:
rol(byte, count)
ror(byte, count)
IFF(expression, valueTrue, valueFalse)
Variable “position” is an index into the input file, starting at 0

Blog Posts

base64dump.py

Description

Extracts and decodes base64 strings (or other encodings) found inside the provided file. base64dump looks for sequences of base64 characters (or other encodings) in the provided file and tries to decode them.

Platform	N/A – Python
Author	Didier Stevens
License	Free / Public Domain
URL	https://blog.didierstevens.com/

Usage

Usage: base64dump.py [options] [file]
Extract base64 strings from file
 
Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -m, --man             Print manual
  -e ENCODING, --encoding=ENCODING
                        select encoding to use (default base64)
  -s SELECT, --select=SELECT
                        select item nr for dumping (a for all)
  -d, --dump            perform dump
  -x, --hexdump         perform hex dump
  -a, --asciidump       perform ascii dump
  -S, --strings         perform strings dump
  -n NUMBER, --number=NUMBER
                        minimum number of bytes in decoded data
  -c CUT, --cut=CUT     cut data
  -w, --ignorewhitespace
                        ignore whitespace

Examples

base64dump.py file.txt

The following output shows the sections that base64dump.py has attempted to decode using base64. However, this file isn’t using the default base64 encoding so see the next example.

remnux@remnux:~$ base64dump.py file.txt
ID  Size    Encoded          Decoded          MD5 decoded                    
--  ----    -------          -------          -----------                    
 1:       8 function         ~�ܶ*'           b1d8813f892c457768a77f88837a6289
 2:       8 wstwaxap         ��pk.�           b5d83e3988cda1f8e903e138131cba91
 3:       8 yaoduhc=         ɪ.�.            c2b2fd4a95ff2e8d6ed65268e8e0a7f7
 4:       8 DDpNVDfX         .:MT7�           9a6466eb801a8374f53d7102a7066290
 5:       8 function         ~�ܶ*'           b1d8813f892c457768a77f88837a6289
 6:       8 kzV0IivL         �5t"+�           a8c4a29cd68eb8da8e0bbe87b3a916c4
 7:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
 8:       8 N1tTAUIH         7[S.B.           118b846fe67df0a2788da838295a1271
 9:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
10:       8 N1tTAUIH         7[S.B.           118b846fe67df0a2788da838295a1271
11:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
12:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
13:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
14:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
15:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
16:       8 function         ~�ܶ*'           b1d8813f892c457768a77f88837a6289
17:       8 S3GBCRNU         Kq�..T           d04eae77c1362316d251db3a3af7a8d5
18:       8 ecBcfdoM         y�\}�.           b185fd8b77394b6c5902b8291c1aa2b6
19:       8 brIW1yTY         n�.�$�           ed0645bcfb574a402ccebc8785ca56f0
20:       8 unescape         �w�q�^           b282069f16d4d9dbee625d0c231a53fd
21:       8 VWAbzxUP         U`.�..           e603829f07f2b06cbe2b53af4d94b716
22:       8 0x400000         �.4�M4           084838d4f4261ed700f3d5ca57681d9f
23:       8 WCoEYFdo         X*.`Wh           9e71afc328eab02982d2cd44d58697bc
24:       8 brIW1yTY         n�.�$�           ed0645bcfb574a402ccebc8785ca56f0
25:       8 N1tTAUIH         7[S.B.           118b846fe67df0a2788da838295a1271
26:       8 VWAbzxUP         U`.�..           e603829f07f2b06cbe2b53af4d94b716
27:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
28:       8 unescape         �w�q�^           b282069f16d4d9dbee625d0c231a53fd
29:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
30:       8 kzV0IivL         �5t"+�           a8c4a29cd68eb8da8e0bbe87b3a916c4
31:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
32:       8 N1tTAUIH         7[S.B.           118b846fe67df0a2788da838295a1271
33:       8 jpwZA7Ef         ..�.           cd49f8f2c65a543daf4dca9899ebf1ea
34:       8 ecBcfdoM         y�\}�.           b185fd8b77394b6c5902b8291c1aa2b6
35:       8 0x400000         �.4�M4           084838d4f4261ed700f3d5ca57681d9f
36:       8 xEzYibKs         �L؉��           40ea154032b38b073adc25c546dba81d
37:       8 jpwZA7Ef         ..�.           cd49f8f2c65a543daf4dca9899ebf1ea
38:       8 DDpNVDfX         .:MT7�           9a6466eb801a8374f53d7102a7066290
39:       8 xEzYibKs         �L؉��           40ea154032b38b073adc25c546dba81d
40:       8 rqYY0o0m         ��.ҍ&           23cad0abd1ac80f7ede1c4a52425625a
41:       8 brIW1yTY         n�.�$�           ed0645bcfb574a402ccebc8785ca56f0
42:       8 function         ~�ܶ*'           b1d8813f892c457768a77f88837a6289
43:       8 Qy9QDRgu         C/P...           16adea19ef8d17f9a2b3368f9e381e08
44:       8 S3GBCRNU         Kq�..T           d04eae77c1362316d251db3a3af7a8d5
45:       8 YTDNPHwC         a0�<|.           5c5496bec5bfb00cecf1a6a3c00036a8
46:       8 unescape         �w�q�^           b282069f16d4d9dbee625d0c231a53fd
47:       8 YTDNPHwC         a0�<|.           5c5496bec5bfb00cecf1a6a3c00036a8
48:       8 YTDNPHwC         a0�<|.           5c5496bec5bfb00cecf1a6a3c00036a8
49:       8 YTDNPHwC         a0�<|.           5c5496bec5bfb00cecf1a6a3c00036a8
50:       4 this             �.�              8e5a04323b343a97433a353a663678b3
51:      16 collectEmailInfo r�ey�D���"w�     128fa58edb7890e176d063411c06b917
52:       4 subj             ���              6214419727646d38fa39dc0c6bc72ee4
53:       8 YTDNPHwC         a0�<|.           5c5496bec5bfb00cecf1a6a3c00036a8
54:       8 Qy9QDRgu         C/P...           16adea19ef8d17f9a2b3368f9e381e08
55:      16 collectEmailInfo r�ey�D���"w�     128fa58edb7890e176d063411c06b917
56:       4 subj             ���              6214419727646d38fa39dc0c6bc72ee4

base64dump.py -e pu file.txt

This example shows how base64dump.py attempts to decode “percent u” encoded base64. You’re normally interested in the section with the largest size.

remnux@remnux:~$ base64dump.py -e pu file.txt
ID  Size    Encoded          Decoded                MD5 decoded                    
--  ----    -------          -------                -----------                    
 1:    1260 %u00e8%u0000%u5d �....]��.��...�=  889060967c0b481fa97ba2fb3447963c
 2:      12 %u9090%u9090     ����                a5cc288c0d8fad7eda458b7241548977
 3:      12 %u0c0c%u0c0c     ....                   d5aba5b36cbaf9dcb46a48418c3d6241

base64dump.py -e pu file.txt s 1 -d > file.bin

In this example, base64dump.py decodes and dumps section 1 from this file and outputs the results to a file named collab.bin. See the previous example for section definitions.

remnux@remnux:~$ base64dump.py -e pu file.txt -s 1 -d > file.bin
remnux@remnux:~$ ls -l file.bin
-rw-rw-r-- 1 remnux remnux 420 Aug 17 18:58 collab.bin
remnux@remnux:~$ file file.bin
collab.bin: data

deobfuscation, linux tools, python, reverse engineering, windows tools

Tag: python