2026-08-04 07:22:23 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文介绍了Volatility内存取证工具的基本使用，包括安装、获取内存样本的方法、Volatility3的插件结构变化、识别镜像信息、列出进程和网络连接、列出DLL以及使用malfind和yarascan进行恶意软件检测。文章强调了Volatility3自动识别操作系统版本的优势，并提供了常用插件的命令示例。 综合评分： 75 文章分类： 渗透测试,恶意软件,应急响应,漏洞分析

cover_image

Memory Forensic – Introduction

原创

漫路修行漫路修行

微痕鉴远

2026年7月15日 10:11 广东

在小说阅读器读本章

去阅读

Volatility 是由 Volatility 实验室开发和维护的免费内存取证工具。

Kali上安装：

apt-get install volatility&nbsp;-y

获取内存样本

可以通过以下这些工具来获取内存快照：

FTK Imager – Link
Redline – Link *Requires registration but Redline has a very nice GUI
DumpIt.exe
win32dd.exe / win64dd.exe – *Has fantastic psexec support, great for IT departments if your EDR solution doesn’t support this
Memoryze
FastDump

这些工具通常会输出一个 .raw 文件，其中包含System内存的image。.raw 文件格式是您将在野外看到的最常见的内存文件格式之一。

但是，只要驱动器未加密，离线机器就可以相对轻松地提取内存。对于 Windows 系统，这可以通过拉取以下文件来完成（我们正在寻找执行内存取证的 Window 系统被错误地关闭了，也可以通过获得这个文件来进行分析）：

%SystemDrive%/hiberfil.sys

虚拟机内存取证：

以下是包含不同虚拟机管理程序的内存映像的内存捕获过程/文件的快速示例：

VMware – .vmem 文件
Hyper-V – .bin 文件
Parallels – .mem 文件
VirtualBox – .sav 文件 这只是部分内存文件。您需要像普通裸机系统一样为该虚拟机管理程序转储内存

Plugins OverView

Volatility3 开始plugin structure 有了大改变。在旧版本中，你需要识别并使用特定版本的OS profile 才能提取。但在3版本开始就不需要了，volatility 可以自动识别 host and build of the memory file.

The naming structure of plugins has also changed. In previous versions of Volatility, the naming convention has been simply the name of the plugin and was universal for all operating systems and profiles. Now with Volatility3, you need to specify the operating system prior to specifying the plugin to be used, for example, windows.info vs linux.info. This is because there are no longer profiles to distinguish between various operating systems for plugins as each operating system has drastically different memory structures and operations. Look below for options of operating system plugin syntax.

.windows
.linux
.mac

There are several plugins available with Volatility as well as third-party plugins; we will only be covering a small portion of the plugins that Volatility has to offer.

To get familiar with the plugins available, utilize the help menu. As Volatility3 is currently in active development, there is still a short list of plugins compared to its python 2 counterpart; however, the current list still allows you to do all of your analysis as needed.

Identifying Image

By default, Volatility comes with all existing Windows profiles from Windows XP to Windows 10.

Image profiles can be hard to determine if you don’t know exactly what version and build the machine you extracted a memory dump from was. In some cases, you may be given a memory file with no other context, and it is up to you to figure out where to go from there. In that case, Volatility has your back and comes with the imageinfo plugin. This plugin will take the provided memory dump and assign it a list of the best possible OS profiles. OS profiles have since been deprecated with Volatility3, so we will only need to worry about identifying the profile if using Volatility2; this makes life much easier for analyzing memory dumps.

Note: imageinfo is not always correct and can have varied results depending on the provided dump; use with caution and test multiple profiles from the provided list.

If we are still looking to get information about what the host is running from the memory dump, we can use the following three plugins windows.info linux.info mac.info. This plugin will provide information about the host from the memory dump.

Syntax: python3 vol.py -f <file> windows.info

Listing Processes and Connections

The most basic way of listing processes is using pslist; this plugin will get the list of processes from the doubly-linked list that keeps track of processes in memory, equivalent to the process list in task manager. The output from this plugin will include all current processes and terminated processes with their exit times.

Some malware, typically rootkits, will, in an attempt to hide their processes, unlink itself from the list. By unlinking themselves from the list you will no longer see their processes when using pslist. To combat this evasion technique, we can use psscan;this technique of listing processes will locate processes by finding data structures that match _EPROCESS. While this technique can help with evasion countermeasures, it can also cause false positives.

The third process plugin, pstree, does not offer any other kind of special techniques to help identify evasion like the last two plugins; however, this plugin will list all processes based on their parent process ID, using the same methods as pslist. This can be useful for an analyst to get a full story of the processes and what may have been occurring at the time of extraction.

# listing processes
python3 vol.py&nbsp;-f&nbsp;<file> windows.pslist

python3 vol.py&nbsp;-f&nbsp;<file> windows.psscan

python3 vol.py&nbsp;-f&nbsp;<file> windows.pstree

network connection

This command in the current state of volatility3 can be very unstable, particularly around old Windows builds. To combat this, you can utilize other tools like bulk_extractor to extract a PCAP file from the memory file. In some cases, this is preferred in network connections that you cannot identify from Volatility alone. https://tools.kali.org/forensics/bulk-extractor

python3 vol.py&nbsp;-f&nbsp;<file> windows.netstat

List dll

list all DLLs associated with processes at the time of extraction

python3 vol.py&nbsp;-f&nbsp;<file> windows.dlllist

Volatility Hunting and Detection Capabilities

It is recommended that you have a basic understanding of how evasion techniques and various malware techniques are employed by adversaries, as well as how to hunt and detect them before going through this section.

The first plugin we will be talking about that is one of the most useful when hunting for code injection is malfind. This plugin will attempt to identify injected processes and their PIDs along with the offset address and a Hex, Ascii, and Disassembly view of the infected area. The plugin works by scanning the heap and identifying processes that have the executable bit set RWE or RX and/or no memory-mapped file on disk (file-less malware).

Based on what malfind identifies, the injected area will change. An MZ header is an indicator of a Windows executable file. The injected area could also be directed towards shellcode which requires further analysis.

Syntax: python3 vol.py -f <file> windows.malfind

Volatility also offers the capability to compare the memory file against YARA rules. yarascan will search for strings, patterns, and compound rules against a rule set. You can either use a YARA file as an argument or list rules within the command line.

Syntax: python3 vol.py -f <file> windows.yarascan

There are other plugins that can be considered part of Volatility’s hunting and detection capabilities; however, we will be covering them in the next task.

Advanced Memory Forensics

当您开始谈论系统对象以及恶意软件如何与系统直接交互时，高级内存取证可能会变得令人困惑，特别是如果您之前没有使用某些技术（例如挂钩和驱动程序操作）的经验。在与高级对手打交道时，您可能会遇到恶意软件，大多数情况下，rootkit 会采用非常恶劣的规避措施，这将要求您作为分析师深入研究驱动程序、互斥体和挂钩函数。许多模块可以帮助我们进一步发现隐藏在内存中的恶意软件。

我们要寻找的第一个规避技术是hooking；攻击者使用五种hooking方法，概述如下：

SSDT Hooks
IRP Hooks
IAT Hooks
EAT Hooks
Inline Hooks

我们将只专注于寻找 SSDT 挂钩，因为这是处理恶意软件规避时最常见的技术之一，也是与基本 volatility 插件一起使用的最简单插件。

As a brief overview of what SSDT hooking is: SSDT stands for System Service Descriptor Table; the Windows kernel uses this table to look up system functions. An adversary can hook into this table and modify pointers to point to a location the rootkit controls.

There can be hundreds of table entries that ssdt will dump; you will then have to analyze the output further or compare against a baseline. A suggestion is to use this plugin after investigating the initial compromise and working off it as part of your lead investigation.

python3 vol.py&nbsp;-f&nbsp;<file> windows.ssdt

Adversaries will also use malicious driver files as part of their evasion. Volatility offers two plugins to list drivers.

The modules plugin will dump a list of loaded kernel modules; this can be useful in identifying active malware. However, if a malicious file is idly waiting or hidden, this plugin may miss it.

This plugin is best used once you have further investigated and found potential indicators to use as input for searching and filtering.

python3 vol.py&nbsp;-f&nbsp;<file> windows.modules

The driverscan plugin will scan for drivers present on the system at the time of extraction. This plugin can help to identify driver files in the kernel that the modules plugin might have missed or were hidden.

As with the last plugin, it is again recommended to have a prior investigation before moving on to this plugin. It is also recommended to look through the modules plugin before driverscan.

python3 vol.py&nbsp;-f&nbsp;<file> windows.driverscan

In most cases, driverscan will come up with no output; however, if you do not find anything with the modules plugin, it can be useful to attempt using this plugin.

There are also other plugins listed below that can be helpful when attempting to hunt for advanced malware in memory.

modscan
driverirp
callbacks
idt
apihooks
moddump
handles

Note: Some of these are only present on Volatility2 or are part of third-party plugins. To get the most out of Volatility, you may need to move to some third-party or custom plugins.

实战练习：

Case 001 – BOB! THIS ISN’T A HORSE!

Your SOC has informed you that they have gathered a memory dump from a quarantined endpoint thought to have been compromised by a banking trojan masquerading as an Adobe document. Your job is to use your knowledge of threat intelligence and reverse engineering to perform memory forensics on the infected host.

You have been informed of a suspicious IP in connection to the file that could be helpful. 41.168.5.140

The memory file is located in /Scenarios/Investigations/Investigation-1.vmem

查看系统信息

python3 vol.py&nbsp;-f&nbsp;/Scenarios/Investigations/Investigation-1.vmem windows.info

查看进程

python3 vol.py&nbsp;-f&nbsp;/Scenarios/Investigations/Investigation-1.vmem windows.psscan

dump process memory

mkdir -p&nbsp;/var/tmp/processinfo1cd /var/tmp/processinfo1vol -f /Scenarios/Investigations/Investigation-1.vmem&nbsp;-o /var/tmp/processinfo1 windows.memmap.Memmap&nbsp;--pid&nbsp;1640&nbsp;--dump

Once the dumping is ready, use:

cd&nbsp;/var/tmp/processinfo1/strings *.dmp | grep -i&nbsp;"user-agent"

分析进程的网络信息：

cd&nbsp;/var/tmp/processinfo1/
strings *.dmp |&nbsp;grep&nbsp;"http"
strings *.dmp |&nbsp;grep&nbsp;"chase"

Case 002 – That Kind of Hurt my Feelings

You have been informed that your corporation has been hit with a chain of ransomware that has been hitting corporations internationally. Your team has already retrieved the decryption key and recovered from the attack. Still, your job is to perform post-incident analysis and identify what actors were at play and what occurred on your systems. You have been provided with a raw memory dump from your team to begin your analysis.

The memory file is located in /Scenarios/Investigations/Investigation-2.raw

vol&nbsp;-f&nbsp;/Scenarios/Investigations/Investigation-2.raw windows.info

查看进程信息

vol&nbsp;-f /Scenarios/Investigations/Investigation-2.raw windows.psscan

dump 进程 memory

mkdir&nbsp;-p /var/tmp/processinfo2cd&nbsp;/var/tmp/processinfo2strings *.dmg | grep exe$

What DLL is loaded by the decryptor used for socket creation in Case 002?

vol&nbsp;-f /Scenarios/Investigations/Investigation-2.raw windows.dlllist | grep&nbsp;740

可以看到windows网络相关api所使用的dll。

What mutex can be found that is a known indicator of the malware in question in Case 002?

问malware使用的互斥量

vol&nbsp;-f&nbsp;/Scenarios/Investigations/Investigation-2.raw windows.handles |grep&nbsp;1940

开始分析内存样本：

准备配置文件 – imageinfo

配置文件决定了 Volatility 如何处理我们的内存映像，因为每个版本的 Windows 都有点不同。现在让我们使用命令 volatility -f MEMORY_FILE.raw imageinfo 查看我们的选项

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem imageinfo

在 Volatility 中运行 imageinfo 命令将为我们提供许多可以测试的配置文件，但是，只有一个是正确的。我们可以使用 pslist 命令测试这些配置文件，通过返回结果的绝对数量来验证我们的配置文件选择。现在使用命令 volatility -f MEMORY_FILE.raw --profile=PROFILE pslist 执行此操作。此内存映像的正确配置文件是什么？（WinXPSP2x86）

查看活动进程：

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 pslist

查看网络情况：

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 netscan

可惜这里因为版本太老了，它不支持 netscan 命令

psview

恶意软件试图隐藏自身以及与之相关的进程是相当常见的。话虽如此，我们可以通过命令“psxview”查看有意隐藏的进程。

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 psxview

查看进程加载的dll

除了通过 psxview 查看隐藏的进程，我们还可以通过命令“ldrmodules”更集中地检查这一点。这里中间会出现三列，InLoad、InInit、InMem。如果其中任何一个是False的，则该模块可能已被注入，这是一件非常糟糕的事情。

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 ldrmodules

检测进程注入

当我们检查机器时，进程并不是我们唯一关心的领域。使用“apihooks”命令，我们可以查看标准系统 DLL 中的意外补丁。如果我们看到一个 Hooking module: 的实例，那就太糟糕了。此命令需要一段时间才能运行，但是，它将向您显示恶意软件引入的所有无关代码。

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 apihooks > apihooks.output

注入的代码可能是一个巨大的问题，并且高度表明非常非常糟糕的事情。我们可以使用命令 malfind 来检查这一点。使用完整命令 volatility -f MEMORY_FILE.raw --profile=PROFILE malfind -D <Destination Directory> 我们不仅可以找到此代码，还可以将其转储到我们指定的目录中。让我们现在就这样做！稍后我们将使用此转储进行更多分析。这会生成多少个文件？

mkdir&nbsp;malfind_output
python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 malfind&nbsp;-D&nbsp;malfind_output

最后但同样重要的是，我们可以查看加载到内存中的所有 DLL。DLL 是在系统进程中使用的共享系统库。这些通常受到劫持和其他侧载攻击，使其成为取证的关键目标。现在让我们使用命令 dlllist 列出内存中的所有 DLL

python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86 dlllist

现在我们已经看到了所有在内存中运行的 DLL，让我们更进一步，将它们拉出来！现在使用命令 volatility -f MEMORY_FILE.raw --profile=PROFILE --pid=PID dlldump -D <Destination Directory> 执行此操作，其中 PID 是我们之前确定的受感染进程的进程 ID（问题 5 和 6 ）。这最终会拉出多少个 DLL？

mkdir&nbsp;dlldump_output
python2 /usr/bin/volatility&nbsp;-f&nbsp;cridex.vmem&nbsp;--profile=WinXPSP2x86&nbsp;--pid=584&nbsp;dlldump&nbsp;-D&nbsp;dlldump_output

把提取出来的 hook 代码上传到VT和Hyber Analysis分析：