Volatility Help - pagefile & hiberfil
Hi all. I've been poking around trying to analyze a pagefile and hiberfil I recovered, but for the life of me, I can't get volatility to play nice with me.
So for starters, I've confirmed via the registry that the processor is AMD64 architecture and that it's Windows 10 19041.1.vbrelease.191206-1406. I've tried using volatility to convert to a raw image (vol -f file.sys imagecopy -O target.raw) and no matter what profile I apply - which, ostensibly should be Win10x6419041 - no plugins will take against it. Not in Volatility 2.6, 3.1, or 3.2. In the latter two, imagecopy is not an available plugin.
I am not sure what I am doing wrong, if I am missing plugins, or what have you, but I would appreciate any guidance. I would buy Arsenal Recon's tools, but that isn't currently an option.
🗣KillithidMindslayer
Volatility won't help you out with your pagefile. You're better off trying bulk extractor, Yara, or even strings.
👤Bad_Grammer_Girl
🎖@malwr
Hi all. I've been poking around trying to analyze a pagefile and hiberfil I recovered, but for the life of me, I can't get volatility to play nice with me.
So for starters, I've confirmed via the registry that the processor is AMD64 architecture and that it's Windows 10 19041.1.vbrelease.191206-1406. I've tried using volatility to convert to a raw image (vol -f file.sys imagecopy -O target.raw) and no matter what profile I apply - which, ostensibly should be Win10x6419041 - no plugins will take against it. Not in Volatility 2.6, 3.1, or 3.2. In the latter two, imagecopy is not an available plugin.
I am not sure what I am doing wrong, if I am missing plugins, or what have you, but I would appreciate any guidance. I would buy Arsenal Recon's tools, but that isn't currently an option.
🗣KillithidMindslayer
Volatility won't help you out with your pagefile. You're better off trying bulk extractor, Yara, or even strings.
👤Bad_Grammer_Girl
🎖@malwr
Reddit
r/computerforensics on Reddit: Volatility Help - pagefile & hiberfil
Posted by u/KillithidMindslayer - 5 votes and 3 comments
🚨 CVE-2022-34502
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
🎖@cveNotify
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
🎖@cveNotify
GitHub
heap-buffer-overflow in WASM name handling after 5.7.0 release · Issue #20336 · radareorg/radare2
Environment Mon Jun 20 03:01:00 PM CST 2022 radare2 5.7.0 28296 @ linux-x86-64 git.5.7.0 commit: 09569c1d5c324df7f23bdc9ad864ac1c25925745 build: 2022-06-20__11:48:07 Linux x86_64 Description After ...
IDA Pro 8.0 released!
ℹ️ Golang 1.18
ℹ️ iOS 16 dyld shared cache support
ℹ️ ARC decompiler
ℹ️ Better firmware analysis
ℹ️ FLAIR pattern generator (makepat)
https://hex-rays.com/products/ida/news/8_0/
🎖@cveNotify
ℹ️ Golang 1.18
ℹ️ iOS 16 dyld shared cache support
ℹ️ ARC decompiler
ℹ️ Better firmware analysis
ℹ️ FLAIR pattern generator (makepat)
https://hex-rays.com/products/ida/news/8_0/
🎖@cveNotify
Hex-Rays
IDA 8.0 | Hex-Rays Docs
🤮4😁3
How does AV know when a process is malicious if it doesnt have a known hash?
🗣Diesl
All AVs have a database of known malicious code and extensions. If the hash is unrecognized it may get quarantined.
👤latnGemin616
🎖@malwr
🗣Diesl
All AVs have a database of known malicious code and extensions. If the hash is unrecognized it may get quarantined.
👤latnGemin616
🎖@malwr
Culbert Report
How AV Hooks NTDLL
How Does AV Know? Have you ever wondered how AV knows what that the application you’re trying to run is malicious when it doesn’t have a known signature? NTDLL is the answer.
👍1
Image displays its own MD5 hash
🗣ASIC_SP
Absolute noob question incoming... What are some practical uses for this?
👤WhatArghThose
There's a mathematical function (maybe in parametric form) whose graph is the "picture of the algebraic equation" of the function itself. I can't find it right now. [not exactly correct, see below\]
EDIT:
Tupper's self-referential formula:
https://en.wikipedia.org/wiki/Tupper%27s_self-referential_formula
👤Acrobatic-Cause-4925
See also: This PDF is an NES ROM that prints its own MD5 hash!
👤cbarrick
🎖@malwr
🗣ASIC_SP
Absolute noob question incoming... What are some practical uses for this?
👤WhatArghThose
There's a mathematical function (maybe in parametric form) whose graph is the "picture of the algebraic equation" of the function itself. I can't find it right now. [not exactly correct, see below\]
EDIT:
Tupper's self-referential formula:
https://en.wikipedia.org/wiki/Tupper%27s_self-referential_formula
👤Acrobatic-Cause-4925
See also: This PDF is an NES ROM that prints its own MD5 hash!
👤cbarrick
🎖@malwr
👍1
Downrange: A Survey of China’s Cyber Ranges - Center for Security and Emerging Technology
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Center for Security and Emerging Technology
Downrange: A Survey of China’s Cyber Ranges | Center for Security and Emerging Technology
China is rapidly building cyber ranges that allow cybersecurity teams to test new tools, practice attack and defense, and evaluate the cybersecurity of a particular product or service. The presence of these facilities suggests a concerted effort on the part…
git-vuln-finder v1.3 released - a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
Release git-vuln-finder v1.3 released - bug fixes release · cve-search/git-vuln-finder
git-vuln-finder v1.3 released - bug fixes released.
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
git-vuln-finder is a python tool to find potential software vulnerabilities from git commit messages. The output format is a JSON with the associ...
Cronos: PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners - leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - Idov31/Cronos: PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.
PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners. - Idov31/Cronos
👍1
List of Free Cybersecurity Services and Tools curated by CISA
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
https://www.cisa.gov/free-cybersecurity-services-and-tools
🗣apes_2gether_strong
🎖@malwr
Cybersecurity and Infrastructure Security Agency CISA
No-Cost Cybersecurity Services & Tools | CISA
BumbleBee: Round Two - In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector to deploy Cobalt Strike and Meterpreter.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The DFIR Report
BumbleBee: Round Two
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates. …
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV [PDF+EXPLOIT](https://github.com/Wh04m1001/ZoneAlarmEoP)
🗣soupcreamychicken
🎖@malwr
🗣soupcreamychicken
🎖@malwr
GitHub
GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV
Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV - GitHub - Wh04m1001/ZoneAlarmEoP: Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV