From 14f449367d68c38211c5cba095dee41d38c60f0a Mon Sep 17 00:00:00 2001 From: cpuu Date: Thu, 4 May 2023 12:52:00 +0900 Subject: [PATCH] Delete getting-started-macos-tutorial.rst --- doc/source/getting-started-macos-tutorial.rst | 154 ------------------ 1 file changed, 154 deletions(-) delete mode 100644 doc/source/getting-started-macos-tutorial.rst diff --git a/doc/source/getting-started-macos-tutorial.rst b/doc/source/getting-started-macos-tutorial.rst deleted file mode 100644 index bc0cb1b92..000000000 --- a/doc/source/getting-started-macos-tutorial.rst +++ /dev/null @@ -1,154 +0,0 @@ -macOS Tutorial -============== - -This guide will give you a brief overview of how volatility3 works as well as a demonstration of several of the plugins available in the suite. - -Acquiring memory ----------------- - -Volatility3 does not provide the ability to acquire memory. The example below is an open source tool. Other commercial tools are also available. - -* `osxpmem `_ - - - -Procedure to create symbol tables for macOS --------------------------------------------- - -To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. - -.. tip:: It may be possible to locate pre-made ISF files from the `download link `_ , - which is built and maintained by `volatilityfoundation `_. - After creating the file or downloading it from the link, place the file under the directory ``volatility3/symbols/mac``. - If necessary create a mac directory under the symbols directory (this will become unnecessary in future versions). - - -Listing plugins ---------------- - -The following is a sample of the macOS plugins available for volatility3, it is not complete and more more plugins may -be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. -For plugin requests, please create an issue with a description of the requested plugin. - -.. code-block:: shell-session - - $ python3 vol.py --help | grep -i mac. | head -n 5 - mac.bash.Bash Recovers bash command history from memory. - mac.check_syscall.Check_syscall - mac.check_sysctl.Check_sysctl - mac.check_trap_table.Check_trap_table - -.. note:: Here the the command is piped to grep and head in-order to provide the start of the list of macOS plugins. - - -Using plugins -------------- - -The following is the syntax to run the volatility CLI. - -.. code-block:: shell-session - - $ python3 vol.py -f - - -Example -------- - -banners -~~~~~~~ - -In this example we will be using a memory dump from the Securinets CTF Quals 2019 Challenge called Contact_me. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge. -Thanks go to `stuxnet `_ for providing this memory dump and `writeup `_. - - -.. code-block:: shell-session - - $ python3 vol.py -f contact_me banners.Banners - - Volatility 3 Framework 2.1.0 - - Progress: 100.00 PDB scanning finished - Offset Banner - - 0x4d2c7d0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - 0xb42b180 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - 0xcda9100 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - 0x1275e7d0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - 0x1284fba4 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - 0x34ad0180 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 - - -The above command helps us to find the memory dump's Darwin kernel version. Now using the above banner we can search for the needed ISF file. -If ISF file cannot be found then, follow the instructions on :ref:`getting-started-macos-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols/mac`` directory. - -mac.pslist -~~~~~~~~~~~~ - -.. code-block:: shell-session - - $ python3 vol.py -f contact_me mac.pslist - - Volatility 3 Framework 2.1.0 Stacking attempts finished - - PID PPID COMM - - 0 0 kernel_task - 1 0 launchd - 35 1 UserEventAgent - 38 1 kextd - 39 1 fseventsd - 37 1 uninstalld - 45 1 configd - 46 1 powerd - 52 1 logd - 58 1 warmd - ..... - -``mac.pslist`` helps us to list the processes which are running, their PIDs and PPIDs. - -mac.pstree -~~~~~~~~~~~~ - -.. code-block:: shell-session - - $ python3 vol.py -f contact_me mac.pstree - Volatility 3 Framework 2.1.0 - Progress: 100.00 Stacking attempts finished - PID PPID COMM - - 35 1 UserEventAgent - 38 1 kextd - 39 1 fseventsd - 37 1 uninstalld - 204 1 softwareupdated - * 449 204 SoftwareUpdateCo - 337 1 system_installd - * 455 337 update_dyld_shar - -``mac.pstree`` helps us to display the parent child relationships between processes. - -mac.ifconfig -~~~~~~~~~~ - -we can use the ``mac.ifconfig`` plugin to get information about the configuration of the network interfaces of the host under investigation. - - -.. code-block:: shell-session - - $ python3 vol.py -f contact_me mac.ifconfig - - Volatility 3 Framework 2.1.0 - Progress: 100.00 Stacking attempts finished - Interface IP Address Mac Address Promiscuous - - lo0 False - lo0 127.0.0.1 False - lo0 ::1 False - lo0 fe80:1::1 False - gif0 False - stf0 False - en0 00:0C:29:89:8B:F0 00:0C:29:89:8B:F0 False - en0 fe80:4::10fb:c89d:217f:52ae 00:0C:29:89:8B:F0 False - en0 192.168.140.128 00:0C:29:89:8B:F0 False - utun0 False - utun0 fe80:5::2a95:bb15:87e3:977c False