下载恶意软件分析诀窍和工具DVD和vol3

下载地址：https://codeload.github.com/ganboing/malwarecookbook/zip/refs/heads/master

然后，下载vol3，并安装：

https://codeload.github.com/volatilityfoundation/volatility3/zip/refs/heads/stable

最初运行的时候，

python D:\Application\volatility3-stable\vol.py -f .\prolaco.vmem\prolaco.vmem windows.pstree.PsTree
Volatility 3 Framework 2.4.1
WARNING volatility3.framework.plugins: Automagic exception occurred: ValueError: Symbol type not in symbol_table_name1 SymbolTable: _ETHREAD

Unsatisfied requirement plugins.PsTree.kernel.symbol_table_name:

A symbol table requirement was not fulfilled. Please verify that:
        The associated translation layer requirement was fulfilled
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsTree.kernel.symbol_table_name']

其中，prolaco.vmem来自恶意软件分析诀窍dvd的vmem数据。

上面的错误表明我的系统缺少了symbols文件，于是就需要：

下载符号表

各种操作系统的符号表包可从以下网址下载：

https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip

然后解压，我将其放到D:\Application\volatility3-stable\volatility3\symbols\windows\下

再运行上述命令：

python D:\Application\volatility3-stable\vol.py -f .\prolaco.vmem\prolaco.vmem windows.pstree.PsTree
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
PID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime

4       0       System  0x810b1660      56      253     N/A     False   N/A     N/A
* 544   4       smss.exe        0xff2ab020      3       21      N/A     False   2010-08-11 06:06:21.000000      N/A
** 608  544     csrss.exe       0xff1ecda0      11      349     0       False   2010-08-11 06:06:23.000000      N/A
** 632  544     winlogon.exe    0xff1ec978      19      565     0       False   2010-08-11 06:06:23.000000      N/A
*** 688 632     lsass.exe       0xff255020      19      341     0       False   2010-08-11 06:06:24.000000      N/A
*** 676 632     services.exe    0xff247020      16      269     0       False   2010-08-11 06:06:24.000000      N/A
**** 1088       676     svchost.exe     0xff22d558      4       75      0       False   2010-08-11 06:06:25.000000     N/A
**** 1028       676     svchost.exe     0x80fbf910      63      1334    0       False   2010-08-11 06:06:24.000000     N/A
***** 888       1028    wscntfy.exe     0xff364310      1       27      0       False   2010-08-11 06:06:49.000000     N/A
***** 468       1028    wuauclt.exe     0x80f94588      3       130     0       False   2010-08-11 06:09:37.000000     N/A
**** 1432       676     spoolsv.exe     0xff1d7da0      13      135     0       False   2010-08-11 06:06:26.000000     N/A
**** 1668       676     vmtoolsd.exe    0xff1b8b28      5       219     0       False   2010-08-11 06:06:35.000000     N/A
**** 1788       676     VMUpgradeHelper 0xff1fdc88      3       97      0       False   2010-08-11 06:06:38.000000     N/A
**** 936        676     svchost.exe     0xff217560      9       256     0       False   2010-08-11 06:06:24.000000     N/A
**** 844        676     vmacthlp.exe    0xff218230      1       24      0       False   2010-08-11 06:06:24.000000     N/A
**** 1968       676     TPAutoConnSvc.e 0xff143b28      5       100     0       False   2010-08-11 06:06:39.000000     N/A
***** 1084      1968    TPAutoConnect.e 0xff38b5f8      1       61      0       False   2010-08-11 06:06:52.000000     N/A
**** 856        676     svchost.exe     0x80ff88d8      16      198     0       False   2010-08-11 06:06:24.000000     N/A
**** 1148       676     svchost.exe     0xff203b80      14      207     0       False   2010-08-11 06:06:26.000000     N/A
**** 216        676     alg.exe 0xff25a7e0      6       104     0       False   2010-08-11 06:06:39.000000      N/A
1724    1708    explorer.exe    0xff3865d0      11      294     0       False   2010-08-11 06:09:29.000000      N/A
* 432   1724    VMwareTray.exe  0xff3667e8      1       49      0       False   2010-08-11 06:09:31.000000      N/A
* 452   1724    VMwareUser.exe  0xff374980      5       176     0       False   2010-08-11 06:09:32.000000      N/A
* 1136  1724    ImmunityDebugge 0xff37a4b0      2       73      0       False   2010-08-11 16:50:19.000000      N/A
PS D:\book\malwarecookbook-master\malwarecookbook-master\15\6> python D:\Application\volatility3-stable\vol.py -f .\prolaco.vmem\prolaco.vmem windows.pstree.PsTree
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
PID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime

4       0       System  0x810b1660      56      253     N/A     False   N/A     N/A
* 544   4       smss.exe        0xff2ab020      3       21      N/A     False   2010-08-11 06:06:21.000000      N/A
** 608  544     csrss.exe       0xff1ecda0      11      349     0       False   2010-08-11 06:06:23.000000      N/A
** 632  544     winlogon.exe    0xff1ec978      19      565     0       False   2010-08-11 06:06:23.000000      N/A
*** 688 632     lsass.exe       0xff255020      19      341     0       False   2010-08-11 06:06:24.000000      N/A
*** 676 632     services.exe    0xff247020      16      269     0       False   2010-08-11 06:06:24.000000      N/A
**** 1088       676     svchost.exe     0xff22d558      4       75      0       False   2010-08-11 06:06:25.000000     N/A
**** 1028       676     svchost.exe     0x80fbf910      63      1334    0       False   2010-08-11 06:06:24.000000     N/A
***** 888       1028    wscntfy.exe     0xff364310      1       27      0       False   2010-08-11 06:06:49.000000     N/A
***** 468       1028    wuauclt.exe     0x80f94588      3       130     0       False   2010-08-11 06:09:37.000000     N/A
**** 1432       676     spoolsv.exe     0xff1d7da0      13      135     0       False   2010-08-11 06:06:26.000000     N/A
**** 1668       676     vmtoolsd.exe    0xff1b8b28      5       219     0       False   2010-08-11 06:06:35.000000     N/A
**** 1788       676     VMUpgradeHelper 0xff1fdc88      3       97      0       False   2010-08-11 06:06:38.000000     N/A
**** 936        676     svchost.exe     0xff217560      9       256     0       False   2010-08-11 06:06:24.000000     N/A
**** 844        676     vmacthlp.exe    0xff218230      1       24      0       False   2010-08-11 06:06:24.000000     N/A
**** 1968       676     TPAutoConnSvc.e 0xff143b28      5       100     0       False   2010-08-11 06:06:39.000000     N/A
***** 1084      1968    TPAutoConnect.e 0xff38b5f8      1       61      0       False   2010-08-11 06:06:52.000000     N/A
**** 856        676     svchost.exe     0x80ff88d8      16      198     0       False   2010-08-11 06:06:24.000000     N/A
**** 1148       676     svchost.exe     0xff203b80      14      207     0       False   2010-08-11 06:06:26.000000     N/A
**** 216        676     alg.exe 0xff25a7e0      6       104     0       False   2010-08-11 06:06:39.000000      N/A
1724    1708    explorer.exe    0xff3865d0      11      294     0       False   2010-08-11 06:09:29.000000      N/A
* 432   1724    VMwareTray.exe  0xff3667e8      1       49      0       False   2010-08-11 06:09:31.000000      N/A
* 452   1724    VMwareUser.exe  0xff374980      5       176     0       False   2010-08-11 06:09:32.000000      N/A
* 1136  1724    ImmunityDebugge 0xff37a4b0      2       73      0       False   2010-08-11 16:50:19.000000      N/A

此外，为了专门测试vol3的常用命令，我从：http://webdiis.unizar.es/~ricardo/sbc-2021/adicional/volcados/alina1G.elf.tar.gz 下载了一个专门测试的vmem文件（虽然叫elf实际上还是windows的vmem），并将其放在在vol3目录，方便以后随时可以用来做命令测试。

python .\vol.py -f .\alina1G.elf windows.info
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
Variable        Value

Kernel Base     0x82805000
DTB     0x185000
Symbols file:///D:/Application/volatility3-stable/volatility3/symbols/windows/ntkrnlmp.pdb/00625D7D36754CBEBA4533BA9A0F3FE2-2.json.xz
Is64Bit False
IsPAE   False
layer_name      0 WindowsIntel
memory_layer    1 Elf64Layer
base_layer      2 FileLayer
KdDebuggerDataBlock     0x82926c28
NTBuildLab      7601.17514.x86fre.win7sp1_rtm.10
CSDVersion      1
KdVersionBlock  0x82926c00
Major/Minor     15.7601
MachineType     332
KeNumberProcessors      1
SystemTime      2019-09-21 12:07:14
NtSystemRoot    C:\Windows
NtProductType   NtProductWinNt
NtMajorVersion  6
NtMinorVersion  1
PE MajorOperatingSystemVersion  6
PE MinorOperatingSystemVersion  1
PE Machine      332
PE TimeDateStamp        Sat Nov 20 08:42:46 2010

补充：如何生成vmem文件

DumpIt【不好用，我win10下会出问题】

DumpIt是一个故障转储工具，该工具是免费的Comae Memory Toolkit的一部分(此工具的早期版本由MoonSols发行，已不再可用)。DumpIt可以获取主机物理内存的快照，并支持使用相关内存取证分析工具如Volatility Framework 、Rekall或Redline 等进行分析。

该工具不适用红队渗透过程，因为产生的转储文件非常巨大，该方法通常用于恶意软件分析。

DumpIt下载地址：

https://github.com/thimbleweed/All-In-USB/tree/master/utilities/DumpIt
https://codeload.github.com/h4sh5/DumpIt-mirror/zip/refs/heads/main 我用的这个

Windows操作系统平台下的DumpIt是一个简单易用的计算机内存镜像获取工具。通常直接将该工具存放在大容量移动硬盘或优盘中。可直接在正在运行Windows系统的平台直接运行，根据提示操作即可。

图表 6 DumpIt内存镜像获取工具

为了测试下这个工具是否好用，我在虚拟机里开几个进程，然后使用dumpit生成了桌面上的mp文件，大小2GB，因为我的内存空间刚好就是2G!

然后对dmp出来的文件分析，看看进程cmd列表：

 python .\vol.py -f .\DESKTOP-JGUS422-20230502-143327.dmp windows.cmdline
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
PID     Process Args

4       System  Required memory at 0x20 is not valid (process exited?)
88      Registry        Required memory at 0x20 is not valid (process exited?)
332     smss.exe        Required memory at 0x78 is not valid (process exited?)
448     csrss.exe       %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
524     wininit.exe     wininit.exe
532     csrss.exe       s(%d) tid(%x) %08X %ws
624     winlogon.exe    winlogon.exe
636     services.exe    C:\Windows\system32\services.exe
672     lsass.exe       C:\Windows\system32\lsass.exe
784     fontdrvhost.ex  Required memory at 0xf35ed79020 is inaccessible (swapped)
788     fontdrvhost.ex  "fontdrvhost.exe"
800     svchost.exe     C:\Windows\system32\svchost.exe -k DcomLaunch -p
900     svchost.exe     C:\Windows\system32\svchost.exe -k RPCSS -p
1000    dwm.exe "dwm.exe"
372     svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
724     svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
668     svchost.exe     C:\Windows\system32\svchost.exe -k LocalService -p
1084    svchost.exe     C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
1212    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1220    svchost.exe     C:\Windows\system32\svchost.exe -k LocalService -p
1296    svchost.exe     C:\Windows\system32\svchost.exe -k netsvcs -p
1312    svchost.exe     C:\Windows\System32\svchost.exe -k NetworkService -p
1472    HipsDaemon.exe  "C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsDaemon.exe" -sHipsDaemon
1720    TrustedInstall  C:\Windows\servicing\TrustedInstaller.exe
1732    MemCompression  Required memory at 0x20 is not valid (process exited?)
1840    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1888    usysdiag.exe    Required memory at 0xba2e22a020 is inaccessible (swapped)
2044    wsctrlsvc.exe   "C:\Program Files (x86)\Huorong\Sysdiag\bin\wsctrlsvc.exe" /svc_run
1068    svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
2000    svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1792    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
2080    svchost.exe     C:\Windows\system32\svchost.exe -k appmodel -p
2160    spoolsv.exe     C:\Windows\System32\spoolsv.exe
2212    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
2268    CompatTelRunne  C:\Windows\system32\compattelrunner.exe
2304    dasHost.exe     dashost.exe {a4107603-4ae0-4d0b-b39719fff08b7465}
2432    svchost.exe     C:\Windows\System32\svchost.exe -k utcsvc -p
2480    Sysmon64.exe    C:\Windows\Sysmon64.exe
2504    VGAuthService.  "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"
2520    vm3dservice.ex  Required memory at 0x1fb80151ae8 is inaccessible (swapped)
2540    vmtoolsd.exe    "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
2640    vm3dservice.ex  vm3dservice.exe -n
2768    unsecapp.exe    ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀ᬹ＀
2936    svchost.exe     C:\Windows\system32\svchost.exe -k wsappx -p
2964    dllhost.exe     C:\Windows\system32\dllhost.exe /Processid:{4350C118-8E48-4788-9048-5D3B49268A2D}
2976    WmiPrvSE.exe    C:\Windows\system32\wbem\wmiprvse.exe
2584    vm3dservice.ex  Required memory at 0x1f49c6b1ae8 is inaccessible (swapped)
2008    dllhost.exe     C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
3492    WmiPrvSE.exe    C:\Windows\system32\wbem\wmiprvse.exe
3688    msdtc.exe       C:\Windows\System32\msdtc.exe
3840    VSSVC.exe       C:\Windows\system32\vssvc.exe
4044    conhost.exe     Required memory at 0x1919ef71ae8 is inaccessible (swapped)
3916    sihost.exe      sihost.exe
3948    svchost.exe     C:\Windows\system32\svchost.exe -k UnistackSvcGroup
3636    taskhostw.exe   taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1608    ctfmon.exe      "ctfmon.exe"
4112    userinit.exe    Required memory at 0x2ac8722020 is not valid (process exited?)
4132    explorer.exe    C:\Windows\Explorer.EXE
4280    ChsIME.exe      C:\Windows\System32\InputMethod\CHS\ChsIME.exe -Embedding
4508    svchost.exe     C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
4796    ShellExperienc  "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
4996    SearchUI.exe    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
4180    RuntimeBroker.  Required memory at 0xa319252020 is inaccessible (swapped)
3480    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
5152    ApplicationFra  C:\Windows\system32\ApplicationFrameHost.exe -Embedding
5176    MicrosoftEdge.  Required memory at 0x1175187020 is inaccessible (swapped)
5240    SkypeApp.exe    Required memory at 0x84502b5020 is inaccessible (swapped)
5248    SkypeBackgroun  Required memory at 0x90248d03 is inaccessible (swapped)
5280    YourPhone.exe   Required memory at 0xe37569a020 is inaccessible (swapped)
5472    WmiApSrv.exe    Required memory at 0x1fc8fec1ae8 is inaccessible (swapped)
5620    browser_broker  Required memory at 0x315fff01315f is not valid (process exited?)
5792    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
5952    RuntimeBroker.
6016    MicrosoftEdgeS  C:\Windows\system32\MicrosoftEdgeSH.exe SCODEF:5176 CREDAT:9730 APH:7800000000006 JITHOST /prefetch:2
6060    MicrosoftEdgeC  Required memory at 0xe02a58e020 is inaccessible (swapped)
2320    WindowsInterna  "C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe" -ServerName:App.AppXagta193n5rpf7mheremt3yyfa1g555vc.mca
6388    SearchIndexer.  C:\Windows\system32\SearchIndexer.exe /Embedding
6568    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
2752    dllhost.exe     Required memory at 0x90ec228020 is inaccessible (swapped)
5020    SgrmBroker.exe  Required memory at 0x9887344020 is not valid (process exited?)
6580    sppsvc.exe      Required memory at 0x35e76fe020 is not valid (process exited?)

但是没有看到cacl.exe也是很诡异。难道是这个dump的文件有问题？？？应该是的！！！

使用vmvare自带的快照dump功能【好用，不会出问题】

继续使用vmvare原生的方法进行dump，先暂停下，然后去

搜索下就可以找到了。

然后继续使用vol3的cmdline命令，这下终于看到calclator.exe了！

python .\vol.py -f .\564d9712-503e-94dd-3e66-ff23e58d1a0e.vmem windows.cmdline
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
PID     Process Args

4       System  Required memory at 0x20 is inaccessible (swapped)
88      Registry        Required memory at 0x20 is not valid (process exited?)
332     smss.exe        Required memory at 0x4f82e97020 is not valid (process exited?)
448     csrss.exe       Required memory at 0x1df22602dc8 is inaccessible (swapped)
524     wininit.exe     wininit.exe
532     csrss.exe       Required memory at 0x179cf8033bc is inaccessible (swapped)
624     winlogon.exe    Required memory at 0x7d52809020 is inaccessible (swapped)
636     services.exe    C:\Windows\system32\services.exe
672     lsass.exe       C:\Windows\system32\lsass.exe
784     fontdrvhost.ex  Required memory at 0xf35ed79020 is inaccessible (swapped)
788     fontdrvhost.ex  "fontdrvhost.exe"
800     svchost.exe     C:\Windows\system32\svchost.exe -k DcomLaunch -p
900     svchost.exe     C:\Windows\system32\svchost.exe -k RPCSS -p
1000    dwm.exe "dwm.exe"
372     svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
724     svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
668     svchost.exe     C:\Windows\system32\svchost.exe -k LocalService -p
1084    svchost.exe     C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
1212    svchost.exe     Process 1212: Required memory at 0x30aaaf6020 is not valid (incomplete layer memory_layer?)
1220    svchost.exe     Required memory at 0xb5fcd9a020 is inaccessible (swapped)
1296    svchost.exe     C:\Windows\system32\svchost.exe -k netsvcs -p
1312    svchost.exe     C:\Windows\System32\svchost.exe -k NetworkService -p
1472    HipsDaemon.exe  "C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsDaemon.exe" -sHipsDaemon
1732    MemCompression  Required memory at 0x20 is not valid (process exited?)
1840    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1888    usysdiag.exe    Required memory at 0xba2e22a020 is inaccessible (swapped)
2044    wsctrlsvc.exe   Required memory at 0xe1e020 is inaccessible (swapped)
1068    svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
2000    svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1792    svchost.exe     Required memory at 0x5f5347c8 is not valid (process exited?)
2080    svchost.exe     C:\Windows\system32\svchost.exe -k appmodel -p
2160    spoolsv.exe     Required memory at 0x3f804fb04677 is not valid (process exited?)
2212    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
2304    dasHost.exe     dashost.exe {a4107603-4ae0-4d0b-b39719fff08b7465}
2432    svchost.exe     C:\Windows\System32\svchost.exe -k utcsvc -p
2480    Sysmon64.exe    C:\Windows\Sysmon64.exe
2504    VGAuthService.  Process 2504: Required memory at 0x7c946d3020 is not valid (incomplete layer memory_layer?)
2520    vm3dservice.ex  Required memory at 0x2813ec1020 is inaccessible (swapped)
2540    vmtoolsd.exe    "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
2640    vm3dservice.ex  Process 2640: Required memory at 0x33c4827020 is not valid (incomplete layer memory_layer?)
2768    unsecapp.exe    C:\Windows\system32\wbem\unsecapp.exe -Embedding
2976    WmiPrvSE.exe    C:\Windows\system32\wbem\wmiprvse.exe
2584    vm3dservice.ex  Required memory at 0x473ca1f020 is inaccessible (swapped)
2008    dllhost.exe     Required memory at 0x9b99370020 is inaccessible (swapped)
3492    WmiPrvSE.exe    C:\Windows\system32\wbem\wmiprvse.exe
3688    msdtc.exe       Required memory at 0x7fa2d611ff79 is not valid (process exited?)
3916    sihost.exe      sihost.exe
3948    svchost.exe     C:\Windows\system32\svchost.exe -k UnistackSvcGroup
3636    taskhostw.exe   taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1608    ctfmon.exe      "ctfmon.exe"
4112    userinit.exe    Required memory at 0x2ac8722020 is not valid (process exited?)
4132    explorer.exe    C:\Windows\Explorer.EXE
4280    ChsIME.exe      C:\Windows\System32\InputMethod\CHS\ChsIME.exe -Embedding
4508    svchost.exe     C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
4796    ShellExperienc  "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
4996    SearchUI.exe    Required memory at 0x20b45c034d8 is inaccessible (swapped)
4180    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
3480    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
5152    ApplicationFra  C:\Windows\system32\ApplicationFrameHost.exe -Embedding
5176    MicrosoftEdge.  Process 5176: Required memory at 0x1175187020 is not valid (incomplete layer memory_layer?)
5240    SkypeApp.exe    Process 5240: Required memory at 0x4502b5020 is not valid (incomplete layer memory_layer?)
5248    SkypeBackgroun  Required memory at 0x8228ff5020 is inaccessible (swapped)
5280    YourPhone.exe   Process 5280: Required memory at 0x637569a020 is not valid (incomplete layer memory_layer?)
5620    browser_broker  Required memory at 0x29d8640020 is inaccessible (swapped)
5792    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
5952    RuntimeBroker.  Required memory at 0xd3f46d7020 is inaccessible (swapped)
6016    MicrosoftEdgeS  Required memory at 0x137b0a03518 is inaccessible (swapped)
6060    MicrosoftEdgeC  Process 6060: Required memory at 0x602a58e020 is not valid (incomplete layer memory_layer?)
2320    WindowsInterna  "C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe" -ServerName:App.AppXagta193n5rpf7mheremt3yyfa1g555vc.mca
6388    SearchIndexer.  C:\Windows\system32\SearchIndexer.exe /Embedding
6568    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
6852    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
6940    smartscreen.ex  C:\Windows\System32\smartscreen.exe -Embedding
6996    SecurityHealth  Required memory at 0x7e6dc0d020 is inaccessible (swapped)
7036    SecurityHealth  C:\Windows\system32\SecurityHealthService.exe
7048    vmtoolsd.exe    "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
7108    HipsTray.exe    Required memory at 0x96a020 is not valid (process exited?)
6184    OneDrive.exe    "C:\Users\bonelee\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
6896    HipsTray.exe    "C:\Program Files (x86)\Huorong\Sysdiag\\bin\HipsTray.exe"
7264    HipsTray.exe    Required memory at 0xbcf020 is not valid (process exited?)
7528    Microsoft.Shar  Required memory at 0x51b9f5020 is not valid (process exited?)
376     dllhost.exe     Required memory at 0x7279e72020 is inaccessible (swapped)
7200    iexplore.exe    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\bonelee\Desktop\normal.html
7296    iexplore.exe    Required memory at 0x2f21cc8 is inaccessible (swapped)
4808    iexplore.exe    Required memory at 0xbe1cc8 is inaccessible (swapped)
7668    WinStore.App.e  Process 7668: Required memory at 0x2bf38034b8 is not valid (incomplete layer memory_layer?)
3008    Calculator.exe  "C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
2076    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
388     RuntimeBroker.  Required memory at 0xdc50f22020 is inaccessible (swapped)
6216    ChsIME.exe      Process 6216: Required memory at 0x7bbfc70020 is not valid (incomplete layer memory_layer?)
5020    SgrmBroker.exe  C:\Windows\system32\SgrmBroker.exe
6448    uhssvc.exe      Process 6448: Required memory at 0x2d911d1ae8 is not valid (incomplete layer memory_layer?)
6764    svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
4480    DumpIt.exe      Required memory at 0x53d7897020 is inaccessible (swapped)
7836    Microsoft.Phot  Required memory at 0xffffffffffe8 is not valid (process exited?)
1260    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding
2036    svchost.exe     C:\Windows\System32\svchost.exe -k NetworkService -p
2100    svchost.exe     C:\Windows\system32\svchost.exe -k SDRSVC
1256    svchost.exe     C:\Windows\system32\svchost.exe -k wsappx -p

其他补充：Windows操作系统平台支持内存获取的常见工具有： ==》基本上都很难下到，todo，实际客户环境里遇到的话，肯定会使用的！

DumpIt （早期版本名为Win32dd）
Belkasoft RAMCapturer
Magnet RAM Capture
WinEn
Winpmem
EnCase Imager
FTK Imager

Linux操作系统常见的内存获取工具：

dd （适合Linux早期版本）
LiME http://code.google.com/p/lime-forensics/
linpmem
Draugr http://code.google.com/p/draugr/
Volatilitux http://code.google.com/p/volatilitux/
Memfetch http://lcamtuf.coredump.cx/
Memdump

Mac OSX操作系统内存获取工具有：

MacMemoryReader
osxpmem
Recon for Mac OSX
Blackbag MacQuisition

我们看下vol3的最新使用方法：

python .\vol.py -h
Volatility 3 Framework 2.4.1
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND] [-p PLUGIN_DIRS]
                  [-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE] [--write-config]
                  [--save-config SAVE_CONFIG] [--clear-cache] [--cache-path CACHE_PATH] [--offline]
                  [--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
                  [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
                  plugin ...

An open-source memory forensics framework

Plugins:
For plugin specific options, run 'volatility <plugin> --help'

plugin
    banners.Banners     Attempts to identify potential linux banners in an image
    configwriter.ConfigWriter
                        Runs the automagics and both prints and outputs configuration in the output directory.
    frameworkinfo.FrameworkInfo
                        Plugin to list the various modular components of Volatility
    isfinfo.IsfInfo     Determines information about the currently available ISF files, or a specific one
    layerwriter.LayerWriter
                        Runs the automagics and writes out the primary layer produced by the stacker.
   linux和mac的插件。。。。
    timeliner.Timeliner
                        Runs all relevant plugins that provide time related information and orders the results by
                        time.

windows的比较多：
    windows.bigpools.BigPools
                        List big page pools.
    windows.cachedump.Cachedump
                        Dumps lsa secrets from memory
    windows.callbacks.Callbacks
                        Lists kernel callbacks and notification routines.
    windows.cmdline.CmdLine
                        Lists process command line arguments.
    windows.crashinfo.Crashinfo
    windows.devicetree.DeviceTree
                        Listing tree based on drivers and attached devices in a particular windows memory image.
    windows.dlllist.DllList
                        Lists the loaded modules in a particular windows memory image.
    windows.driverirp.DriverIrp
                        List IRPs for drivers in a particular windows memory image.
    windows.drivermodule.DriverModule
                        Determines if any loaded drivers were hidden by a rootkit
    windows.driverscan.DriverScan
                        Scans for drivers present in a particular windows memory image.
    windows.dumpfiles.DumpFiles
                        Dumps cached file contents from Windows memory samples.
    windows.envars.Envars
                        Display process environment variables
    windows.filescan.FileScan
                        Scans for file objects present in a particular windows memory image.
    windows.getservicesids.GetServiceSIDs
                        Lists process token sids.
    windows.getsids.GetSIDs
                        Print the SIDs owning each process
    windows.handles.Handles
                        Lists process open handles.
    windows.hashdump.Hashdump
                        Dumps user hashes from memory
    windows.info.Info   Show OS & kernel details of the memory sample being analyzed.
    windows.joblinks.JobLinks
                        Print process job link information
    windows.ldrmodules.LdrModules
    windows.lsadump.Lsadump
                        Dumps lsa secrets from memory
    windows.malfind.Malfind
                        Lists process memory ranges that potentially contain injected code.
    windows.mbrscan.MBRScan
                        Scans for and parses potential Master Boot Records (MBRs)
    windows.memmap.Memmap
                        Prints the memory map
    windows.mftscan.MFTScan
                        Scans for MFT FILE objects present in a particular windows memory image.
    windows.modscan.ModScan
                        Scans for modules present in a particular windows memory image.
    windows.modules.Modules
                        Lists the loaded kernel modules.
    windows.mutantscan.MutantScan
                        Scans for mutexes present in a particular windows memory image.
    windows.netscan.NetScan
                        Scans for network objects present in a particular windows memory image.
    windows.netstat.NetStat
                        Traverses network tracking structures present in a particular windows memory image.
    windows.poolscanner.PoolScanner
                        A generic pool scanner plugin.
    windows.privileges.Privs
                        Lists process token privileges
    windows.pslist.PsList
                        Lists the processes present in a particular windows memory image.
    windows.psscan.PsScan
                        Scans for processes present in a particular windows memory image.
    windows.pstree.PsTree
                        Plugin for listing processes in a tree based on their parent process ID.
    windows.registry.certificates.Certificates
                        Lists the certificates in the registry's Certificate Store.
    windows.registry.hivelist.HiveList
                        Lists the registry hives present in a particular memory image.
    windows.registry.hivescan.HiveScan
                        Scans for registry hives present in a particular windows memory image.
    windows.registry.printkey.PrintKey
                        Lists the registry keys under a hive or specific key value.
    windows.registry.userassist.UserAssist
                        Print userassist registry keys and information.
    windows.sessions.Sessions
                        lists Processes with Session information extracted from Environmental Variables
    windows.skeleton_key_check.Skeleton_Key_Check
                        Looks for signs of Skeleton Key malware
    windows.ssdt.SSDT   Lists the system call table.
    windows.statistics.Statistics
    windows.strings.Strings
                        Reads output from the strings command and indicates which process(es) each string belongs to.
    windows.svcscan.SvcScan
                        Scans for windows services.
    windows.symlinkscan.SymlinkScan
                        Scans for links present in a particular windows memory image.
    windows.vadinfo.VadInfo
                        Lists process memory ranges.
    windows.vadwalk.VadWalk
                        Walk the VAD tree.
    windows.vadyarascan.VadYaraScan
                        Scans all the Virtual Address Descriptor memory maps using yara.
    windows.verinfo.VerInfo
                        Lists version information from PE files.
    windows.virtmap.VirtMap
                        Lists virtual mapped sections.
    yarascan.YaraScan   Scans kernel memory using yara rules (string or file).

例如，我要看进程对应的cmdline：

python .\vol.py -f .\alina1G.elf windows.cmdline
Volatility 3 Framework 2.4.1
Progress:  100.00               PDB scanning finished
PID     Process Args

4       System  Required memory at 0x10 is not valid (process exited?)
268     smss.exe        \SystemRoot\System32\smss.exe
348     csrss.exe       %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
384     wininit.exe     wininit.exe
392     csrss.exe       %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
432     winlogon.exe    winlogon.exe
476     services.exe    C:\Windows\system32\services.exe
484     lsass.exe       C:\Windows\system32\lsass.exe
492     lsm.exe C:\Windows\system32\lsm.exe
596     svchost.exe     C:\Windows\system32\svchost.exe -k DcomLaunch
660     VBoxService.ex  system32\VBoxService.exe
712     svchost.exe     C:\Windows\system32\svchost.exe -k RPCSS
764     svchost.exe     C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
884     svchost.exe     C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
928     svchost.exe     C:\Windows\system32\svchost.exe -k netsvcs
988     audiodg.exe     C:\Windows\system32\AUDIODG.EXE 0x2b4
1096    svchost.exe     C:\Windows\system32\svchost.exe -k LocalService
1228    svchost.exe     C:\Windows\system32\svchost.exe -k NetworkService
1308    spoolsv.exe     C:\Windows\System32\spoolsv.exe
1344    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1448    svchost.exe     C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1864    taskhost.exe    "taskhost.exe"
1924    dwm.exe "C:\Windows\system32\Dwm.exe"
1940    explorer.exe    C:\Windows\Explorer.EXE
316     VBoxTray.exe    "C:\Windows\System32\VBoxTray.exe"
1876    SearchIndexer.  C:\Windows\system32\SearchIndexer.exe /Embedding
320     SearchProtocol  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1943312967-2543331679-1049226392-10021_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1943312967-2543331679-1049226392-10021 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"  "1"
1128    SearchFilterHo  "C:\Windows\system32\SearchFilterHost.exe" 0 504 508 516 65536 512
1828    ALINA_CJLXYJ.e  ALINA=C:\Users\Usuario\Desktop\ALINA_mod.exe

接下来就是孰能生巧了！