Comments (4)
if the problem is about generating a profile, use volatility3 instead of rekall.
Libvmi is now compatible with volatility3 JSON profiles
from nitro.
Libvmi is now compatible with volatility3 JSON profiles
Thanks a lot for replying!!!
In my reply, I want to describe how I generated the profile, and the reason why I think it worked normally. I'll upload the profile then.
And finally I'll upload the output of one execution, to highlight a few facts which may help.
Generate the profile
I generated is as is mentioned in rekall blog.
1.Scan the memory image.
rekall -f tmp6zmoy6h_ version_scan --name_regex krnl -v
offset | guid | pdb |
---|---|---|
0x3c6a590 | ECE191A20CFF4465AE46DF96C22638451 | ntkrnlmp.pdb |
0x635ddb80 | 8FD1049FD5044670A9FD6A6890DAE9611 | ntoskrnl.pdb |
And it's ntkrnlmp.pdb with GUID ECE191A20CFF4465AE46DF96C22638451 which works. (Sometimes there was ntoskrnl.pdb in the scanning result, sometime not.)
2.Fetch ntkrnlmp.pdb from windows server.
rekall fetch_pdb ntkrnlmp ECE191A20CFF4465AE46DF96C22638451 --dump_dir ~/Desktop/pdbdump -v
2020-10-14 23:34:50,850:DEBUG:rekall.1:Logging level set to 10
2020-10-14 23:34:50,850:DEBUG:rekall.1:Running plugin (fetch_pdb) with args (()) kwargs ({'pdb_filename': 'ntkrnlmp', 'guid': 'F8E2A8B5C9B74BF4A6E4A48F180099942', 'verbosity': 1, 'dump_dir': '/home/qp/Desktop/pdbdump_2'})
And then I got ntkrnlmp. (This step could not succeed when I try to fetch ntoskrnl.pdb with error 404 NOT FOUND. However, as is in the rekall blog, I think only ntkrnlmp is the key to generate profile.)
3.Parse ntkrnlmp and generate profile.
rekall parse_pdb /home/qp/Desktop/pdbdump_3/ntkrnlmp --output_filename /home/qp/Desktop/pdbdump/ECE191A20CFF4465AE46DF96C22638451.json --windows_version 6.1 -v
2020-10-15 10:45:02,684:DEBUG:rekall.1:Logging level set to 10
2020-10-15 10:45:02,684:DEBUG:rekall.1:Running plugin (parse_pdb) with args (()) kwargs ({'windows_version': '6.1', 'concise': None, 'verbosity': 1, 'output_filename': '/home/qp/Desktop/pdbdump_3/ECE191A20CFF4465AE46DF96C22638451.json', 'pdb_filename': '/home/qp/Desktop/pdbdump_3/ntkrnlmp', 'dump_dir': None, 'profile_class': None})
2020-10-15 10:45:05,591:DEBUG:rekall.1:Opened url https://github.com/google/rekall-profiles/raw/master/v1.0/inventory.gz
2020-10-15 10:45:05,887:DEBUG:rekall.1:Opened local file /home/qp/.rekall_cache/v1.0/inventory.gz
2020-10-15 10:45:06,663:DEBUG:rekall.1:Opened url http://profiles.rekall-forensic.com/v1.0/inventory
2020-10-15 10:45:07,402:WARNING:rekall.1:Inventory for repository "http://profiles.rekall-forensic.com" seems malformed. Are you behind a captive portal or proxy? If this is a custom repository, did you forget to create an inventory? You must use the tools/profiles/build_profile_repo.py tool with the --inventory flag.
2020-10-15 10:45:07,402:WARNING:rekall.1:Repository http://profiles.rekall-forensic.com will be disabled.
2020-10-15 10:45:10,264:DEBUG:rekall.1:Opened url https://github.com/google/rekall-profiles/raw/master/v1.0/mspdb.gz
2020-10-15 10:45:10,279:DEBUG:rekall.1:Adding mspdb to local cache.
2020-10-15 10:45:10,298:INFO:rekall.1:Loaded profile mspdb from Local Cache Directory:/home/qp/.rekall_cache (in 2.89582109451 sec)
And then I got my profile. I try to upload the profile in case you want to view it.
ECE191A20CFF4465AE46DF96C22638451.txt
I try to analyze my memory images with this profile. (Both images generated from running nitro or nitro/debug/memdump.py are actually the same I think, using libvirt Elf64CoreDump
.)
rekall -f win7x64.raw --profile ~/Desktop/pdbdump/ECE191A20CFF4465AE46DF96C22638451.json
2020-10-21 17:35:40,007:WARNING:rekall.1:Unable to determine file size, assuming file is volatile.
—
The Rekall Digital Forensic/Incident Response framework 1.7.2.rc1 (Hurricane Ridge).
"We can remember it for you wholesale!"
This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License.
See http://www.rekall-forensic.com/docs/Manual/tutorial.html to get started.
—
[1] win7x64.raw 17:35:43> pslist
—> pslist()
_EPROCESS name pid ppid thread_count handle_count session_id wow64 process_create_time process_exit_time
‘’-------------- -------------------- ----- ------ ------------ ------------ ---------- ------ ------------------------ ------------------------‘’
Out<17:35:43> Plugin: pslist (WinPsList)
[1] win7x64.raw 17:35:43>
Only svchost.exe can be caught
In fact, a few days ago, I didn't realize that rekall repository had non public profile which matched my virtual machine. So nitro (called rekall) always reported the error RuntimeError: Unable to find a valid profile for this image. Try using -v for more details
. And after I managed to generate the profile mentioned above, there is not the error anymore. But here comes the new error Process not found.
It's weird that I can get nothing but svchost.exe
. And sometimes no process at all. Here I'll upload the output of one excecution.
output.txt
And in the file, the output of get_symbols.py is as below.
{"syscall_table": [["m", {"plugin_name": "ssdt", "tool_name": "rekall", "cookie": 19, "tool_version": "1.7.2.rc1", "session": {"session_id": 1, "state": {"ept": [null, "IntParser"], "profile": ["/home/qp/Desktop/pdbdump_5/a.json", "FileName"], "filename": ["/tmp/tmpgomez6g9/tmpqb22ssj3", "FileName"], "pagefile": [null, "FileName"], "session_name": [null, "String"], "timezone": [null, "TimeZone"]}, "mro": "Session:object", "id": 18}}], ["p", "Elf64CoreDump|tmpqb22ssj3: Merging Address Ranges 0x0 -"], ["p", "Scanning buffer 0x3c00000->0x4600000 (0xa00000)"], ["t", [{"name": "divider", "type": "Divider"}, {"name": "entry_obj", "hidden": true}, {"name": "entry", "style": "address"}, {"name": "target", "style": "address"}, {"name": "symbol"}], {}], ["x"]], "offsets": {"KPROCESS": {"DirectoryTableBase": 40}, "EPROCESS": {"ActiveProcessLinks": 392, "ImageFileName": 736, "UniqueProcessId": 384, "InheritedFromUniqueProcessId": 656, "Wow64Process": 800, "CreateTime": 360, "SeAuditProcessCreationInfo": 912, "Peb": 824}, "SE_AUDIT_PROCESS_CREATION_INFO": {"ImageFileName": 0}, "OBJECT_NAME_INFORMATION": {"Name": 0}, "PEB": {"ProcessParameters": 32}, "RTL_USER_PROCESS_PARAMETERS": {"CommandLine": 112}}}
Another potential problem is that when extracting symbols with rekall, there's a warning of file size.
Extracting symbols with Rekall
WARNING:root:Unable to determine file size, assuming file is volatile.
Last, every time after I run nitro and this error happens, the virtual machine is "dead". And I can only force it off.
Once again, thank you!
from nitro.
I've solved this problem by using an older version of Windows7, with it's profile in the repository.
from nitro.
I've solved this problem by using an older version of Windows7, with it's profile in the repository.
But now, nitro (or rekall) can not analyze the correct syscall, that is, "fullname"="Table0!Unknown" or "Table1!Unknown","name"="Unknown". I'll try to find something useful in all the nitro/issues.
from nitro.
Related Issues (20)
- Configuration Format
- Use case planning HOT 3
- Backend dispatch_hook exception handling HOT 2
- Minor mistake in libvmi.py HOT 1
- problem about the nitro/readme.md HOT 2
- Some questions about requirements! HOT 1
- Question about setup test vm. HOT 22
- A question about get syscall argument value. HOT 3
- Invalid Qemu command line argument definitions in domain template HOT 6
- Questions about realization of nitro!
- Improve nitro's performance. HOT 6
- Finding process in kernel mode HOT 5
- process_event() will not necessarly return the right syscall HOT 1
- nitro can hook the function which from user level?
- what's the exactly combination to use nitro? HOT 3
- Why is the name of syscall unknown? HOT 5
- Can Nitro extract the API in windows DLL?
- No module named 'nitro.libvmi'
- RuntimeError: Error: fail to attach to the VM
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nitro.