{"id":538,"date":"2019-09-28T20:40:53","date_gmt":"2019-09-28T18:40:53","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=538"},"modified":"2025-03-21T14:50:34","modified_gmt":"2025-03-21T13:50:34","slug":"forensic","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=538","title":{"rendered":"Memory dump"},"content":{"rendered":"\n

After\u00adwards: See Ana\u00adlyz\u00ading memory<\/a><\/p>\n\n\n\n

Linux<\/h2>\n\n\n\n

Prozess memory dump<\/h3>\n\n\n\n

Find out which mem\u00ado\u00adry seg\u00adments are used by an appli\u00adca\u00adtion via its PID<\/span>:<\/p>\n\n\n\n

cat \/proc\/<pid>\/maps<\/pre>\n\n\n\n
Dump the used mem\u00ado\u00adry from an appli\u00adca\u00adtion: (cred\u00adit<\/a>)<\/p>\n\n\n\n
#!\/bin\/bash\n\ngrep rw-p \/proc\/$1\/maps \\\n| sed -n 's\/^\\([0-9a-f]*\\)-\\([0-9a-f]*\\) .*$\/\\1 \\2\/p' \\\n| while read start stop; do \\\n  gdb --batch --pid $1 -ex \\\n    \"dump memory $1-$start-$stop.dump 0x$start 0x$stop\"; \\\ndone<\/pre>\n\n\n\n
Complete memory dump<\/h3>\n\n\n\n
fmem<\/h4>\n\n\n\n
Requires root priv\u00adi\u00adleges. Could be out\u00addat\u00aded and not work on new\u00ader lin\u00adux machines.<\/em><\/p>\n\n\n\n
    \n
  1. Down\u00adload fmem ker\u00adnel mod\u00adule: https:\/\/github.com\/NateBrune\/fmem<\/a><\/li>\n\n\n\n
  2. make &<\/span>&<\/span> .\/run to com\u00adpile and add it to the kernel<\/li>\n\n\n\n
  3. dd if=\/dev\/fmem of=memory.dd bs=1MB<\/span> count=512 \u2014 for 512 MB<\/span> RAM<\/span>. Adjust accordingly.<\/li>\n<\/ol>\n\n\n\n
    lime<\/h4>\n\n\n\n
      \n
    1. git clone https:\/\/github.com\/504ensicsLabs\/LiME<\/li>\n\n\n\n
    2. cd src<\/li>\n\n\n\n
    3. make<\/li>\n\n\n\n
    4. Load the mod\u00adule and cre\u00adate the image: 
        \n
      1. Into a local file: ins\u00admod lime-<generated-module>.ko \u201cpath=\/<output-file>.mem format=lime\u201d<\/li>\n\n\n\n
      2. Into a remote file: 
          \n
        1. On the vic\u00adtim: ins\u00admod lime-<generated-module>.ko \u201cpath=tcp:4444 format=lime\u201d<\/li>\n\n\n\n
        2. On the tar\u00adget: nc <vic\u00adtim-ip> 4444 > system.mem<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n\n\n\n
        3. Cre\u00adat\u00ading a sys\u00adtem pro\u00adfile (maybe: apt-get install dwarfdump): 
            \n
          1. git clone https:\/\/github.com\/volatilityfoundation\/volatility.git<\/li>\n\n\n\n
          2. cd volatility\/tools\/linux<\/li>\n\n\n\n
          3. make<\/li>\n\n\n\n
          4. zip <system-name>.zip module.dwarf \/boot\/Sys\u00adtem-map-of-cur\u00adrent-ker\u00adnel<\/li>\n\n\n\n
          5. Copy <system-name>.zip to the tar\u00adget server.<\/li>\n<\/ol>\n<\/li>\n\n\n\n
          6. On the tar\u00adget server: 
              \n
            1. Copy <system-name>.zip into the plugins\/overlays\/linux\/ directory.<\/li>\n\n\n\n
            2. Make sure that the new pro\u00adfile is loaded with python vol.py \u2013info | grep <sys\u00adtem-name><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n
              Recall<\/h4>\n\n\n\n
              Frame\u00adwork for mem\u00ado\u00adry inves\u00adti\u00adga\u00adtion: https:\/\/github.com\/google\/rekall<\/p>\n\n\n\n
              Cheat sheet: https:\/\/digital-forensics.sans.org\/media\/rekall-memory-forensics-cheatsheet.pdf<\/p>\n\n\n\n
              Could\u00adn\u2019t build on a Vm. hm\u2026<\/p>\n\n\n\n
              Windows<\/h2>\n\n\n\n
              Files, which also con\u00adtains memory:<\/p>\n\n\n\n