You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -6,41 +6,47 @@ This guide will give you a brief overview of how volatility3 works as well as a
6
6
Acquiring memory
7
7
----------------
8
8
9
-
Volatility3 does not provide the ability to acquire memory. Below are some examples of tools that can be used to acquire memory, but more are available:
9
+
Volatility3 does not provide the ability to acquire memory. Below is an example of a tool that can be used to acquire memory on Linux systems:
10
10
11
11
* `AVML - Acquire Volatile Memory for Linux <https://github.com/microsoft/avml>`_
12
-
* `LiME - Linux Memory Extract <https://github.com/504ensicsLabs/LiME>`_
13
12
14
-
Be aware that LiME raw format is not supported by volatility3, the padded or lime option should be used instead. `This issue contains further information <https://github.com/504ensicsLabs/LiME/issues/111>`_.
13
+
Other tools may exist, but please verify their maintenance status and compatibility with volatility3 before use.
15
14
16
-
Procedure to create symbol tables for linux
17
-
--------------------------------------------
15
+
Procedure to create symbol tables for Linux
16
+
-------------------------------------------
18
17
19
-
To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`.
18
+
It is recommended to first check the repository `volatility3-symbols <https://github.com/Abyss-W4tcher/volatility3-symbols>`_ for pre-generated JSON.xz symbol table files.
19
+
This repository provides files organized by kernel version for popular Linux distributions such as Debian, Ubuntu, and AlmaLinux.
20
+
21
+
If you cannot find a suitable symbol table for your kernel version there, please refer to :ref:`symbol-tables:Mac or Linux symbol tables` to create one manually.
22
+
23
+
After creating the file, place it under the directory ``volatility3/symbols``.
24
+
Volatility3 will automatically detect and use symbol tables from this location.
20
25
21
-
.. tip:: It may be possible to locate pre-made ISF files from the `Linux ISF Server <https://isf-server.techanarchy.net/>`_ ,
22
-
which is built and maintained by `kevthehermit <https://twitter.com/kevthehermit>`_.
23
-
After creating the file or downloading it from the ISF server, place the file under the directory ``volatility3/symbols/linux``.
24
-
If necessary create a linux directory under the symbols directory (this will become unnecessary in future versions).
25
26
26
27
27
28
Listing plugins
28
29
---------------
29
30
30
-
The following is a sample of the linux plugins available for volatility3, it is not complete and more plugins may
31
-
be added. For a complete reference, please see the volatility 3 :doc:`list of plugins <volatility3.plugins>`.
32
-
For plugin requests, please create an issue with a description of the requested plugin.
31
+
Volatility3 currently supports over 40 Linux-specific plugins covering a wide range of forensic analysis needs, such as process enumeration, memory-mapped file inspection, loaded modules, and kernel tracing features.
32
+
33
+
Some representative plugins include:
34
+
35
+
- ``linux.pslist``: Lists running processes with their PIDs and PPIDs.
36
+
- ``linux.bash``: Recovers bash command history from memory.
banners.Banners Attempts to identify potential linux banners in an
38
-
linux.bash.Bash Recovers bash command history from memory.
39
-
linux.malware.check_afinfo.Check_afinfo
40
-
linux.malware.check_creds.Check_creds
41
-
linux.malware.check_idt.Check_idt
47
+
$ python3 vol.py --help | grep -i linux.
42
48
43
-
.. note:: Here the command is piped to grep and head to provide the start of the list of linux plugins.
49
+
.. note:: You can also filter and inspect available plugins using more sophisticated patterns or tools like ``grep``, ``awk``, or simply explore the source under ``volatility3/framework/plugins/linux``.
44
50
45
51
46
52
Using plugins
@@ -60,14 +66,14 @@ banners
60
66
~~~~~~~
61
67
62
68
In this example we will be using a memory dump from the Insomni'hack teaser 2020 CTF Challenge called Getdents. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge.
63
-
Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memory dump and `writeup <https://stuxnet999.github.io/insomnihack/2020/09/17/Insomihack-getdents.html>`_.
69
+
Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memory dump and `writeup <https://stuxnet999.github.io/dfir/insomnihack-teaser-2020-getdents/>`_.
64
70
65
71
66
72
.. code-block:: shell-session
67
73
68
74
$ python3 vol.py -f memory.vmem banners
69
75
70
-
Volatility 3 Framework 2.0.1
76
+
Volatility 3 Framework 2.26.0
71
77
72
78
Progress: 100.00 PDB scanning finished
73
79
Offset Banner
@@ -79,85 +85,79 @@ Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memo
79
85
0x7fde0010 Linux version 4.15.0-72-generic (buildd@lcy01-amd64-026) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #81-Ubuntu SMP Tue Nov 26 12:20:02 UTC 2019 (Ubuntu 4.15.0-72.81-generic 4.15.18)
80
86
81
87
82
-
The above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for the needed ISF file from the ISF server.
83
-
If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory.
88
+
The above command helps us identify the kernel version and distribution from the memory dump.
89
+
Using this information, follow the instructions in :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux` to generate the required ISF file.
90
+
Once created, place the file under the ``volatility3/symbols`` directory so that Volatility3 can recognize it automatically.
91
+
92
+
linux.boottime
93
+
~~~~~~~~~~~~~~
94
+
95
+
This plugin provides the system boot time extracted from memory.
96
+
It is useful for establishing a timeline, particularly when analyzing incident response scenarios or determining system uptime.
97
+
98
+
.. code-block:: shell-session
99
+
100
+
$ python3 vol.py -f memory.vmem linux.boottime
101
+
102
+
Volatility 3 Framework 2.26.0
103
+
Progress: 100.00 Stacking attempts finished
104
+
105
+
TIME NS Boot Time
106
+
107
+
- 2022-02-10 06:50:16.450008 UTC
108
+
109
+
This timestamp can serve as a reference point for correlating system events, such as process start times, logs, or malicious activity.
84
110
85
-
.. tip:: Use the banner text which is most repeated to search on the ISF Server.
86
111
87
112
linux.pslist
88
113
~~~~~~~~~~~~
89
114
115
+
This plugin lists active processes by walking the task list from memory.
116
+
It provides detailed metadata for each process, including identifiers and user/group information.
It helps identify unusual or suspicious process structures such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution.
158
+
The tree view is particularly useful for spotting anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships.
159
+
160
+
161
161
162
162
linux.bash
163
163
~~~~~~~~~~
@@ -168,7 +168,7 @@ Now to find the commands that were run in the bash shell by using ``linux.bash``
168
168
169
169
$ python3 vol.py -f memory.vmem linux.bash
170
170
171
-
Volatility 3 Framework 2.0.1
171
+
Volatility 3 Framework 2.26.0
172
172
Progress: 100.00 Stacking attempts finished
173
173
PID Process CommandTime Command
174
174
@@ -177,17 +177,85 @@ Now to find the commands that were run in the bash shell by using ``linux.bash``
Network configuration is an essential aspect of memory forensics.
189
+
Analyzing the network interfaces and their IP assignments can reveal active connections, misconfigured settings, or even artifacts of malicious activity.
190
+
191
+
Volatility3 provides the following two plugins to examine this information:
192
+
193
+
**linux.ip.Addr** displays IP-related metadata for each interface, including IPv4/IPv6 addresses, MAC, scope, and interface status.
194
+
195
+
.. code-block:: shell-session
196
+
197
+
$ python3 vol.py -f memory.vmem linux.ip.Addr
198
+
199
+
NetNS Index Interface MAC Promiscuous IP Prefix Scope Type State
200
+
4026531992 2 enp0s3 08:00:27:8a:4d:eb False 10.0.2.15 24 global UP
201
+
...
202
+
203
+
**linux.ip.Link** shows lower-level link information such as MTU, Qdisc, and interface flags.
204
+
205
+
.. code-block:: shell-session
206
+
207
+
$ python3 vol.py -f memory.vmem linux.ip.Link
208
+
209
+
NS Interface MAC State MTU Qdisc Qlen Flags
210
+
4026531992 enp0s3 08:00:27:8a:4d:eb UP 1500 fq_codel 1000 BROADCAST,LOWER_UP,MULTICAST,UP
211
+
212
+
Together, these plugins help investigators assess the system’s network exposure and identify anomalies such as multiple network namespaces, unexpected IP addresses, or active interfaces in promiscuous mode.
213
+
214
+
linux.malfind
215
+
~~~~~~~~~~~~~
216
+
217
+
This plugin scans process memory for suspicious executable regions that may indicate code injection or malicious payloads.
218
+
It is particularly useful for detecting fileless malware, injected shellcode, or unpacked runtime payloads that do not correspond to legitimate binary files on disk.
219
+
220
+
.. code-block:: shell-session
221
+
222
+
$ python3 vol.py -f memory.vmem linux.malfind
223
+
224
+
Volatility 3 Framework 2.26.0
225
+
Progress: 100.00 Stacking attempts finished
226
+
PID Process Start End Path Protection Hexdump Disasm
- **PID / Process**: Identifies the target process (in this case, `networkd-dispat`, PID 540)
240
+
- **Start / End**: The memory address range of the suspicious region
241
+
- **Path**: Indicates that the region is an anonymous memory mapping (i.e., not backed by a file)
242
+
- **Protection**: The region is marked `rwx` (read-write-execute), which is uncommon for legitimate memory regions
243
+
- **Disasm**: Shows the disassembled machine code found in that memory region
244
+
245
+
**Key indicators to focus on:**
246
+
247
+
- **Anonymous Mapping + rwx**: Memory that is not backed by a file and has execute permissions is often used for injected code
248
+
- **Disassembly patterns**: Repetitive `add` instructions, `nop`, or unusual instruction sequences can be artifacts of shellcode, packer stubs, or JIT-compiled code
249
+
- **Process context**: The suspicious memory is found in `networkd-dispat`, a system service — if this service is not expected to have dynamic executable memory regions, it may be compromised
250
+
251
+
Use this plugin early in an investigation to flag processes for deeper inspection.
252
+
253
+
Further Exploration and Contribution
254
+
------------------------------------
255
+
256
+
This guide has introduced several key Linux plugins available in Volatility 3 for memory forensics.
257
+
However, many more plugins are available, covering topics such as kernel modules, page cache analysis, tracing frameworks, and malware detection.
258
+
259
+
If you identify gaps in plugin functionality or wish to extend support for a specific analysis use case, you are encouraged to contribute new plugins or enhancements.
260
+
Your insights can help shape the future of Linux memory forensics.
0 commit comments