mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
Jaeyou PARKandGitHub
514f9d6a11
Add a warning directive to the macOS tutorial noting that macOS analysis support is no longer actively maintained as of the Volatility 3 parity release. The existing plugins remain available but may not receive future updates. Links to the official announcement for details.
160 lines
6.2 KiB
ReStructuredText
160 lines
6.2 KiB
ReStructuredText
macOS Tutorial
|
|
==============
|
|
|
|
.. warning::
|
|
|
|
As of the Volatility 3 parity release, macOS analysis support is no longer actively maintained.
|
|
The existing macOS plugins remain available but may not receive future updates or bug fixes.
|
|
For more details, see the `official announcement <https://volatilityfoundation.org/announcing-the-official-parity-release-of-volatility-3/>`_.
|
|
|
|
This guide will give you a brief overview of how volatility3 works as well as a demonstration of several of the plugins available in the suite.
|
|
|
|
Acquiring memory
|
|
----------------
|
|
|
|
Volatility3 does not provide the ability to acquire memory. The example below is an open source tool. Other commercial tools are also available.
|
|
|
|
* `osxpmem <https://github.com/Velocidex/c-aff4/releases/download/3.2/osxpmem_3.2.zip>`_
|
|
|
|
|
|
|
|
Procedure to create symbol tables for macOS
|
|
--------------------------------------------
|
|
|
|
To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`.
|
|
|
|
.. tip:: It may be possible to locate pre-made ISF files from the `download link <https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip>`_ ,
|
|
which is built and maintained by `volatilityfoundation <https://www.volatilityfoundation.org/>`_.
|
|
After creating the file or downloading it from the link, place the file under the directory ``volatility3/symbols/``.
|
|
|
|
|
|
Listing plugins
|
|
---------------
|
|
|
|
The following is a sample of the macOS plugins available for volatility3, it is not complete and more plugins may
|
|
be added. For a complete reference, please see the volatility 3 :doc:`list of plugins <volatility3.plugins>`.
|
|
For plugin requests, please create an issue with a description of the requested plugin.
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py --help | grep -i mac. | head -n 4
|
|
mac.bash.Bash Recovers bash command history from memory.
|
|
mac.check_syscall.Check_syscall
|
|
mac.check_sysctl.Check_sysctl
|
|
mac.check_trap_table.Check_trap_table
|
|
|
|
.. note:: Here the command is piped to grep and head to provide the start of the list of macOS plugins.
|
|
|
|
|
|
Using plugins
|
|
-------------
|
|
|
|
The following is the syntax to run the volatility CLI.
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py -f <path to memory image> <plugin_name> <plugin_option>
|
|
|
|
|
|
Example
|
|
-------
|
|
|
|
banners
|
|
~~~~~~~
|
|
|
|
In this example we will be using a memory dump from the Securinets CTF Quals 2019 Challenge called Contact_me. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge.
|
|
Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memory dump and `writeup <https://stuxnet999.github.io/securinets-ctf/2019/08/24/SecurinetsQuals2019-Contact-Me.html>`_.
|
|
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py -f contact_me banners.Banners
|
|
|
|
Volatility 3 Framework 2.4.2
|
|
|
|
Progress: 100.00 PDB scanning finished
|
|
Offset Banner
|
|
|
|
0x4d2c7d0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
0xb42b180 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
0xcda9100 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
0x1275e7d0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
0x1284fba4 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
0x34ad0180 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64
|
|
|
|
|
|
The above command helps us to find the memory dump's Darwin kernel version. Now using the above banner we can search for the needed ISF file.
|
|
If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-mac-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols`` directory.
|
|
|
|
mac.pslist
|
|
~~~~~~~~~~
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py -f contact_me mac.pslist.PsList
|
|
|
|
Volatility 3 Framework 2.4.2
|
|
Progress: 100.00 Stacking attempts finished
|
|
|
|
PID PPID COMM
|
|
|
|
0 0 kernel_task
|
|
1 0 launchd
|
|
35 1 UserEventAgent
|
|
38 1 kextd
|
|
39 1 fseventsd
|
|
37 1 uninstalld
|
|
45 1 configd
|
|
46 1 powerd
|
|
52 1 logd
|
|
58 1 warmd
|
|
.....
|
|
|
|
``mac.pslist`` helps us to list the processes which are running, their PIDs and PPIDs.
|
|
|
|
mac.pstree
|
|
~~~~~~~~~~
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py -f contact_me mac.pstree.PsTree
|
|
Volatility 3 Framework 2.4.2
|
|
Progress: 100.00 Stacking attempts finished
|
|
PID PPID COMM
|
|
|
|
35 1 UserEventAgent
|
|
38 1 kextd
|
|
39 1 fseventsd
|
|
37 1 uninstalld
|
|
204 1 softwareupdated
|
|
* 449 204 SoftwareUpdateCo
|
|
337 1 system_installd
|
|
* 455 337 update_dyld_shar
|
|
|
|
``mac.pstree`` helps us to display the parent-child relationships between processes.
|
|
|
|
mac.ifconfig
|
|
~~~~~~~~~~~~
|
|
|
|
.. code-block:: shell-session
|
|
|
|
$ python3 vol.py -f contact_me mac.ifconfig.Ifconfig
|
|
|
|
Volatility 3 Framework 2.4.2
|
|
Progress: 100.00 Stacking attempts finished
|
|
Interface IP Address Mac Address Promiscuous
|
|
|
|
lo0 False
|
|
lo0 127.0.0.1 False
|
|
lo0 ::1 False
|
|
lo0 fe80:1::1 False
|
|
gif0 False
|
|
stf0 False
|
|
en0 00:0C:29:89:8B:F0 00:0C:29:89:8B:F0 False
|
|
en0 fe80:4::10fb:c89d:217f:52ae 00:0C:29:89:8B:F0 False
|
|
en0 192.168.140.128 00:0C:29:89:8B:F0 False
|
|
utun0 False
|
|
utun0 fe80:5::2a95:bb15:87e3:977c False
|
|
|
|
We can use the ``mac.ifconfig`` plugin to get information about the configuration of the network interfaces of the host under investigation.
|