内存取证完整指南：Volatility 3实战、内存获取与分析技术

memory-forensics by sickn33/antigravity-awesome-skills

129 周安装量

31,300 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill memory-forensics

逆向工程系统管理安全

🇨🇳中文介绍

内存取证

用于事件响应和恶意软件分析的全面技术，涵盖从内存转储中获取、分析和提取痕迹。

在以下情况下使用此技能

处理内存取证任务或工作流时
需要内存取证的指导、最佳实践或检查清单时

在以下情况下不要使用此技能

任务与内存取证无关时
需要此范围之外的不同领域或工具时

使用说明

明确目标、约束条件和所需输入。
应用相关最佳实践并验证结果。
提供可操作的步骤和验证方法。
如果需要详细示例，请打开 resources/implementation-playbook.md。

内存获取

实时获取工具

Windows

# WinPmem (推荐)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# 基于图形界面，输出 raw 格式

# Magnet RAM Capture
# 基于图形界面，输出 raw 格式

Linux

# LiME (Linux 内存提取器)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (受限，需要权限)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF 格式)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (商业软件)

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

恶意软件分析工作流

# 1. 初始进程概览
vol -f memory.raw windows.pstree > processes.txt
vol -f memory.raw windows.pslist > pslist.txt

# 2. 网络连接
vol -f memory.raw windows.netscan > network.txt

# 3. 检测注入
vol -f memory.raw windows.malfind > malfind.txt

# 4. 分析可疑进程
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.handles --pid <PID>

# 5. 转储可疑可执行文件
vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. 从转储文件中提取字符串
strings -a pid.<PID>.exe > strings.txt

# 7. YARA 扫描
vol -f memory.raw windows.yarascan --yara-rules malware.yar

事件响应工作流

# 1. 事件时间线
vol -f memory.raw windows.timeliner > timeline.csv

# 2. 用户活动
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.consoles

# 3. 持久化机制
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. 服务
vol -f memory.raw windows.svcscan

# 5. 计划任务
vol -f memory.raw windows.scheduled_tasks

# 6. 最近文件
vol -f memory.raw windows.filescan | grep -i "recent"

Windows 进程结构

// EPROCESS (执行进程)
typedef struct _EPROCESS {
    KPROCESS Pcb;                    // 内核进程块
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    // ...
    LIST_ENTRY ActiveProcessLinks;   // 双向链表
    ULONG_PTR UniqueProcessId;       // PID
    // ...
    PEB* Peb;                        // 进程环境块
    // ...
} EPROCESS;

// PEB (进程环境块)
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;
    BOOLEAN ReadImageFileExecOptions;
    BOOLEAN BeingDebugged;           // 反调试检查
    // ...
    PVOID ImageBaseAddress;          // 可执行文件基地址
    PPEB_LDR_DATA Ldr;              // 加载器数据 (DLL 列表)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    // ...
} PEB;

VAD (虚拟地址描述符)

typedef struct _MMVAD {
    MMVAD_SHORT Core;
    union {
        ULONG LongFlags;
        MMVAD_FLAGS VadFlags;
    } u;
    // ...
    PVOID FirstPrototypePte;
    PVOID LastContiguousPte;
    // ...
    PFILE_OBJECT FileObject;
} MMVAD;

// 内存保护标志
#define PAGE_EXECUTE           0x10
#define PAGE_EXECUTE_READ      0x20
#define PAGE_EXECUTE_READWRITE 0x40
#define PAGE_EXECUTE_WRITECOPY 0x80

# Malfind 指标
# - PAGE_EXECUTE_READWRITE 保护 (可疑)
# - 非映像 VAD 区域中的 MZ 头
# - 分配起始处的 Shellcode 模式

# 常见注入技术
# 1. 经典 DLL 注入
#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. 进程镂空
#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC 注入
#    - QueueUserAPC 针对可警告线程

# 4. 线程执行劫持
#    - SuspendThread + SetThreadContext + ResumeThread

# 比较进程列表
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt  # 隐藏的进程

# 检查 DKOM (直接内核对象操作)
vol -f memory.raw windows.callbacks

# 检测挂钩函数
vol -f memory.raw windows.ssdt  # 系统服务描述符表

# 驱动程序分析
vol -f memory.raw windows.driverscan
vol -f memory.raw windows.driverirp

# 转储哈希 (需要先获取 hivelist)
vol -f memory.raw windows.hashdump

# LSA 机密信息
vol -f memory.raw windows.lsadump

# 缓存的域凭据
vol -f memory.raw windows.cachedump

# Mimikatz 风格提取
# 需要特定插件/工具

编写内存 YARA 规则

rule Suspicious_Injection
{
    meta:
        description = "检测常见的注入 shellcode"

    strings:
        // 常见的 shellcode 模式
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // 函数序言
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // 推送哈希，调用

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "检测内存中的 Cobalt Strike beacon"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}

# 扫描所有进程内存
vol -f memory.raw windows.yarascan --yara-rules rules.yar

# 扫描特定进程
vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# 扫描内核内存
vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel

# 基本字符串提取
strings -a memory.raw > all_strings.txt

# Unicode 字符串
strings -el memory.raw >> all_strings.txt

# 从进程转储中针对性提取
vol -f memory.raw windows.memmap --pid 1234 --dump
strings -a pid.1234.dmp > process_strings.txt

# 模式匹配
grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt

使用 FLOSS 提取混淆字符串

# FLOSS 提取混淆字符串
floss malware.exe > floss_output.txt

# 从内存转储中提取
floss pid.1234.dmp

最小化足迹：使用轻量级获取工具
记录一切：记录捕获时间、工具和哈希值
验证完整性：捕获后立即对内存转储进行哈希
证据链：保持适当的取证处理流程

从宏观开始：深入分析前先获取概览
交叉引用：对相同数据使用多个插件
时间线关联：将内存发现与磁盘/网络发现关联起来
记录发现：保留详细的笔记和截图
验证结果：通过多种方法验证发现

陈旧数据：内存是易失性的，需及时分析
不完整的转储：验证转储大小是否与预期 RAM 匹配
符号问题：确保使用正确操作系统版本的符号文件
涂抹效应：内存可能在获取过程中发生变化
加密：某些数据可能在内存中已加密

🇺🇸English

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Use this skill when

Working on memory forensics tasks or workflows
Needing guidance, best practices, or checklists for memory forensics

Do not use this skill when

The task is unrelated to memory forensics
You need a different domain or tool outside this scope

Instructions

Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.

Memory Acquisition

Live Acquisition Tools

Windows

# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format

Linux

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)

Virtual Machine Memory

# VMware: .vmem file is raw memory
cp vm.vmem memory.raw

# VirtualBox: Use debug console
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V
# Checkpoint contains memory state

Volatility 3 Framework

Installation and Setup

# Install Volatility 3
pip install volatility3

# Install symbol tables (Windows)
# Download from https://downloads.volatilityfoundation.org/volatility3/symbols/

# Basic usage
vol -f memory.raw <plugin>

# With symbol path
vol -f memory.raw -s /path/to/symbols windows.pslist

Essential Plugins

Process Analysis

# List processes
vol -f memory.raw windows.pslist

# Process tree (parent-child relationships)
vol -f memory.raw windows.pstree

# Hidden process detection
vol -f memory.raw windows.psscan

# Process memory dumps
vol -f memory.raw windows.memmap --pid <PID> --dump

# Process environment variables
vol -f memory.raw windows.envars --pid <PID>

# Command line arguments
vol -f memory.raw windows.cmdline

Network Analysis

# Network connections
vol -f memory.raw windows.netscan

# Network connection state
vol -f memory.raw windows.netstat

DLL and Module Analysis

# Loaded DLLs per process
vol -f memory.raw windows.dlllist --pid <PID>

# Find hidden/injected DLLs
vol -f memory.raw windows.ldrmodules

# Kernel modules
vol -f memory.raw windows.modules

# Module dumps
vol -f memory.raw windows.moddump --pid <PID>

Memory Injection Detection

# Detect code injection
vol -f memory.raw windows.malfind

# VAD (Virtual Address Descriptor) analysis
vol -f memory.raw windows.vadinfo --pid <PID>

# Dump suspicious memory regions
vol -f memory.raw windows.vadyarascan --yara-rules rules.yar

Registry Analysis

# List registry hives
vol -f memory.raw windows.registry.hivelist

# Print registry key
vol -f memory.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Dump registry hive
vol -f memory.raw windows.registry.hivescan --dump

File System Artifacts

# Scan for file objects
vol -f memory.raw windows.filescan

# Dump files from memory
vol -f memory.raw windows.dumpfiles --pid <PID>

# MFT analysis
vol -f memory.raw windows.mftscan

Linux Analysis

# Process listing
vol -f memory.raw linux.pslist

# Process tree
vol -f memory.raw linux.pstree

# Bash history
vol -f memory.raw linux.bash

# Network connections
vol -f memory.raw linux.sockstat

# Loaded kernel modules
vol -f memory.raw linux.lsmod

# Mount points
vol -f memory.raw linux.mount

# Environment variables
vol -f memory.raw linux.envars

macOS Analysis

# Process listing
vol -f memory.raw mac.pslist

# Process tree
vol -f memory.raw mac.pstree

# Network connections
vol -f memory.raw mac.netstat

# Kernel extensions
vol -f memory.raw mac.lsmod

Analysis Workflows

Malware Analysis Workflow

# 1. Initial process survey
vol -f memory.raw windows.pstree > processes.txt
vol -f memory.raw windows.pslist > pslist.txt

# 2. Network connections
vol -f memory.raw windows.netscan > network.txt

# 3. Detect injection
vol -f memory.raw windows.malfind > malfind.txt

# 4. Analyze suspicious processes
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.handles --pid <PID>

# 5. Dump suspicious executables
vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. Extract strings from dumps
strings -a pid.<PID>.exe > strings.txt

# 7. YARA scanning
vol -f memory.raw windows.yarascan --yara-rules malware.yar

Incident Response Workflow

# 1. Timeline of events
vol -f memory.raw windows.timeliner > timeline.csv

# 2. User activity
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.consoles

# 3. Persistence mechanisms
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. Services
vol -f memory.raw windows.svcscan

# 5. Scheduled tasks
vol -f memory.raw windows.scheduled_tasks

# 6. Recent files
vol -f memory.raw windows.filescan | grep -i "recent"

Data Structures

Windows Process Structures

// EPROCESS (Executive Process)
typedef struct _EPROCESS {
    KPROCESS Pcb;                    // Kernel process block
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    // ...
    LIST_ENTRY ActiveProcessLinks;   // Doubly-linked list
    ULONG_PTR UniqueProcessId;       // PID
    // ...
    PEB* Peb;                        // Process Environment Block
    // ...
} EPROCESS;

// PEB (Process Environment Block)
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;
    BOOLEAN ReadImageFileExecOptions;
    BOOLEAN BeingDebugged;           // Anti-debug check
    // ...
    PVOID ImageBaseAddress;          // Base address of executable
    PPEB_LDR_DATA Ldr;              // Loader data (DLL list)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    // ...
} PEB;

VAD (Virtual Address Descriptor)

typedef struct _MMVAD {
    MMVAD_SHORT Core;
    union {
        ULONG LongFlags;
        MMVAD_FLAGS VadFlags;
    } u;
    // ...
    PVOID FirstPrototypePte;
    PVOID LastContiguousPte;
    // ...
    PFILE_OBJECT FileObject;
} MMVAD;

// Memory protection flags
#define PAGE_EXECUTE           0x10
#define PAGE_EXECUTE_READ      0x20
#define PAGE_EXECUTE_READWRITE 0x40
#define PAGE_EXECUTE_WRITECOPY 0x80

Detection Patterns

Process Injection Indicators

# Malfind indicators
# - PAGE_EXECUTE_READWRITE protection (suspicious)
# - MZ header in non-image VAD region
# - Shellcode patterns at allocation start

# Common injection techniques
# 1. Classic DLL Injection
#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. Process Hollowing
#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC Injection
#    - QueueUserAPC targeting alertable threads

# 4. Thread Execution Hijacking
#    - SuspendThread + SetThreadContext + ResumeThread

Rootkit Detection

# Compare process lists
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt  # Hidden processes

# Check for DKOM (Direct Kernel Object Manipulation)
vol -f memory.raw windows.callbacks

# Detect hooked functions
vol -f memory.raw windows.ssdt  # System Service Descriptor Table

# Driver analysis
vol -f memory.raw windows.driverscan
vol -f memory.raw windows.driverirp

Credential Extraction

# Dump hashes (requires hivelist first)
vol -f memory.raw windows.hashdump

# LSA secrets
vol -f memory.raw windows.lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump

# Mimikatz-style extraction
# Requires specific plugins/tools

YARA Integration

Writing Memory YARA Rules

rule Suspicious_Injection
{
    meta:
        description = "Detects common injection shellcode"

    strings:
        // Common shellcode patterns
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // Function prologue
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // Push hash, call

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}

Scanning Memory

# Scan all process memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar

# Scan specific process
vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# Scan kernel memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel

String Analysis

Extracting Strings

# Basic string extraction
strings -a memory.raw > all_strings.txt

# Unicode strings
strings -el memory.raw >> all_strings.txt

# Targeted extraction from process dump
vol -f memory.raw windows.memmap --pid 1234 --dump
strings -a pid.1234.dmp > process_strings.txt

# Pattern matching
grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt

FLOSS for Obfuscated Strings

# FLOSS extracts obfuscated strings
floss malware.exe > floss_output.txt

# From memory dump
floss pid.1234.dmp

Best Practices

Acquisition Best Practices

Minimize footprint : Use lightweight acquisition tools
Document everything : Record time, tool, and hash of capture
Verify integrity : Hash memory dump immediately after capture
Chain of custody : Maintain proper forensic handling

Analysis Best Practices

Start broad : Get overview before deep diving
Cross-reference : Use multiple plugins for same data
Timeline correlation : Correlate memory findings with disk/network
Document findings : Keep detailed notes and screenshots
Validate results : Verify findings through multiple methods

Common Pitfalls

Stale data : Memory is volatile, analyze promptly
Incomplete dumps : Verify dump size matches expected RAM
Symbol issues : Ensure correct symbol files for OS version
Smear : Memory may change during acquisition
Encryption : Some data may be encrypted in memory

Weekly Installs

Repository

sickn33/antigra…e-skills

GitHub Stars

27.1K

First Seen

Jan 28, 2026

Security Audits

Gen Agent Trust HubPass SocketWarn SnykWarn

Installed on

opencode82

gemini-cli81

claude-code80

cursor80

github-copilot78

codex78

Lark Mail CLI 使用指南：邮件管理、安全规则与自动化工作流

37,000 周安装

内存取证完整指南：Volatility 3实战、内存获取与分析技术

🇨🇳中文介绍

内存取证

在以下情况下使用此技能

在以下情况下不要使用此技能

使用说明

内存获取

实时获取工具

Windows

Linux

macOS

相关 Skills

虚拟机内存

Volatility 3 框架

安装与设置

核心插件

进程分析

网络分析

DLL 与模块分析

内存注入检测

注册表分析

文件系统痕迹

Linux 分析

macOS 分析

分析工作流

恶意软件分析工作流

事件响应工作流

数据结构

Windows 进程结构

VAD (虚拟地址描述符)

检测模式

进程注入指标

Rootkit 检测

凭据提取

YARA 集成

编写内存 YARA 规则

扫描内存

字符串分析

提取字符串

使用 FLOSS 提取混淆字符串

最佳实践

获取最佳实践

分析最佳实践

常见陷阱

🇺🇸English

Memory Forensics

Use this skill when

Do not use this skill when

Instructions

Memory Acquisition

Live Acquisition Tools

Windows

Linux

macOS

Virtual Machine Memory

Volatility 3 Framework

Installation and Setup

Essential Plugins

Process Analysis

Network Analysis

DLL and Module Analysis

Memory Injection Detection

Registry Analysis

File System Artifacts

Linux Analysis

macOS Analysis

Analysis Workflows

Malware Analysis Workflow

Incident Response Workflow

Data Structures

Windows Process Structures

VAD (Virtual Address Descriptor)

Detection Patterns

Process Injection Indicators

Rootkit Detection

Credential Extraction

YARA Integration

Writing Memory YARA Rules

Scanning Memory

String Analysis