内存取证技术指南：Volatility 3 实战与恶意软件分析工具

memory-forensics by wshobson/agents

3,500 周安装量

32,200 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/wshobson/agents --skill memory-forensics

数据分析监控安全

🇨🇳中文介绍

内存取证

用于事件响应和恶意软件分析的全面技术，涵盖从内存转储中获取、分析和提取证据。

内存获取

实时获取工具

Windows

# WinPmem (推荐)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# 基于图形界面，输出 raw 格式

# Magnet RAM Capture
# 基于图形界面，输出 raw 格式

Linux

# LiME (Linux 内存提取器)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (有限制，需要权限)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF 格式)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (商业软件)

虚拟机内存

# VMware: .vmem 文件即为原始内存
cp vm.vmem memory.raw

# VirtualBox: 使用调试控制台
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V
# 检查点包含内存状态

Volatility 3 框架

安装与设置

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

恶意软件分析工作流

# 1. 初始进程概览
vol -f memory.raw windows.pstree > processes.txt
vol -f memory.raw windows.pslist > pslist.txt

# 2. 网络连接
vol -f memory.raw windows.netscan > network.txt

# 3. 检测注入
vol -f memory.raw windows.malfind > malfind.txt

# 4. 分析可疑进程
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.handles --pid <PID>

# 5. 转储可疑可执行文件
vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. 从转储文件中提取字符串
strings -a pid.<PID>.exe > strings.txt

# 7. YARA 扫描
vol -f memory.raw windows.yarascan --yara-rules malware.yar

事件响应工作流

# 1. 事件时间线
vol -f memory.raw windows.timeliner > timeline.csv

# 2. 用户活动
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.consoles

# 3. 持久化机制
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. 服务
vol -f memory.raw windows.svcscan

# 5. 计划任务
vol -f memory.raw windows.scheduled_tasks

# 6. 最近文件
vol -f memory.raw windows.filescan | grep -i "recent"

Windows 进程结构

// EPROCESS (执行进程)
typedef struct _EPROCESS {
    KPROCESS Pcb;                    // 内核进程块
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    // ...
    LIST_ENTRY ActiveProcessLinks;   // 双向链表
    ULONG_PTR UniqueProcessId;       // PID
    // ...
    PEB* Peb;                        // 进程环境块
    // ...
} EPROCESS;

// PEB (进程环境块)
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;
    BOOLEAN ReadImageFileExecOptions;
    BOOLEAN BeingDebugged;           // 反调试检查
    // ...
    PVOID ImageBaseAddress;          // 可执行文件基地址
    PPEB_LDR_DATA Ldr;              // 加载器数据 (DLL 列表)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    // ...
} PEB;

VAD (虚拟地址描述符)

typedef struct _MMVAD {
    MMVAD_SHORT Core;
    union {
        ULONG LongFlags;
        MMVAD_FLAGS VadFlags;
    } u;
    // ...
    PVOID FirstPrototypePte;
    PVOID LastContiguousPte;
    // ...
    PFILE_OBJECT FileObject;
} MMVAD;

// 内存保护标志
#define PAGE_EXECUTE           0x10
#define PAGE_EXECUTE_READ      0x20
#define PAGE_EXECUTE_READWRITE 0x40
#define PAGE_EXECUTE_WRITECOPY 0x80

# Malfind 指标
# - PAGE_EXECUTE_READWRITE 保护 (可疑)
# - 非镜像 VAD 区域中的 MZ 头
# - 分配起始处的 Shellcode 模式

# 常见注入技术
# 1. 经典 DLL 注入
#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. 进程镂空
#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC 注入
#    - QueueUserAPC 针对可警告线程

# 4. 线程执行劫持
#    - SuspendThread + SetThreadContext + ResumeThread

# 比较进程列表
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt  # 隐藏进程

# 检查 DKOM (直接内核对象操作)
vol -f memory.raw windows.callbacks

# 检测挂钩函数
vol -f memory.raw windows.ssdt  # 系统服务描述符表

# 驱动程序分析
vol -f memory.raw windows.driverscan
vol -f memory.raw windows.driverirp

# 转储哈希值 (需要先获取 hivelist)
vol -f memory.raw windows.hashdump

# LSA 密钥
vol -f memory.raw windows.lsadump

# 缓存的域凭据
vol -f memory.raw windows.cachedump

# Mimikatz 风格提取
# 需要特定插件/工具

编写内存 YARA 规则

rule Suspicious_Injection
{
    meta:
        description = "检测常见注入 shellcode"

    strings:
        // 常见 shellcode 模式
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // 函数序言
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // 推送哈希，调用

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "检测内存中的 Cobalt Strike beacon"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}

# 扫描所有进程内存
vol -f memory.raw windows.yarascan --yara-rules rules.yar

# 扫描特定进程
vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# 扫描内核内存
vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel

# 基本字符串提取
strings -a memory.raw > all_strings.txt

# Unicode 字符串
strings -el memory.raw >> all_strings.txt

# 从进程转储中定向提取
vol -f memory.raw windows.memmap --pid 1234 --dump
strings -a pid.1234.dmp > process_strings.txt

# 模式匹配
grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt

使用 FLOSS 分析混淆字符串

# FLOSS 提取混淆字符串
floss malware.exe > floss_output.txt

# 从内存转储中提取
floss pid.1234.dmp

最小化足迹 : 使用轻量级获取工具
记录所有信息 : 记录捕获时间、工具和哈希值
验证完整性 : 捕获后立即对内存转储进行哈希
证据链 : 保持适当的取证处理流程

从宏观开始 : 在深入分析前先获取概览
交叉引用 : 对相同数据使用多个插件
时间线关联 : 将内存发现与磁盘/网络证据关联
记录发现 : 保持详细的笔记和截图
验证结果 : 通过多种方法验证发现

陈旧数据 : 内存是易失性的，需及时分析
不完整的转储 : 验证转储大小是否与预期 RAM 匹配
符号问题 : 确保使用对应操作系统版本的符号文件
涂抹效应 : 获取过程中内存可能发生变化
加密 : 某些数据可能在内存中已加密

🇺🇸English

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Memory Acquisition

Live Acquisition Tools

Windows

# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format

Linux

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

macOS

# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)

Virtual Machine Memory

# VMware: .vmem file is raw memory
cp vm.vmem memory.raw

# VirtualBox: Use debug console
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V
# Checkpoint contains memory state

Volatility 3 Framework

Installation and Setup

# Install Volatility 3
pip install volatility3

# Install symbol tables (Windows)
# Download from https://downloads.volatilityfoundation.org/volatility3/symbols/

# Basic usage
vol -f memory.raw <plugin>

# With symbol path
vol -f memory.raw -s /path/to/symbols windows.pslist

Essential Plugins

Process Analysis

# List processes
vol -f memory.raw windows.pslist

# Process tree (parent-child relationships)
vol -f memory.raw windows.pstree

# Hidden process detection
vol -f memory.raw windows.psscan

# Process memory dumps
vol -f memory.raw windows.memmap --pid <PID> --dump

# Process environment variables
vol -f memory.raw windows.envars --pid <PID>

# Command line arguments
vol -f memory.raw windows.cmdline

Network Analysis

# Network connections
vol -f memory.raw windows.netscan

# Network connection state
vol -f memory.raw windows.netstat

DLL and Module Analysis

# Loaded DLLs per process
vol -f memory.raw windows.dlllist --pid <PID>

# Find hidden/injected DLLs
vol -f memory.raw windows.ldrmodules

# Kernel modules
vol -f memory.raw windows.modules

# Module dumps
vol -f memory.raw windows.moddump --pid <PID>

Memory Injection Detection

# Detect code injection
vol -f memory.raw windows.malfind

# VAD (Virtual Address Descriptor) analysis
vol -f memory.raw windows.vadinfo --pid <PID>

# Dump suspicious memory regions
vol -f memory.raw windows.vadyarascan --yara-rules rules.yar

Registry Analysis

# List registry hives
vol -f memory.raw windows.registry.hivelist

# Print registry key
vol -f memory.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Dump registry hive
vol -f memory.raw windows.registry.hivescan --dump

File System Artifacts

# Scan for file objects
vol -f memory.raw windows.filescan

# Dump files from memory
vol -f memory.raw windows.dumpfiles --pid <PID>

# MFT analysis
vol -f memory.raw windows.mftscan

Linux Analysis

# Process listing
vol -f memory.raw linux.pslist

# Process tree
vol -f memory.raw linux.pstree

# Bash history
vol -f memory.raw linux.bash

# Network connections
vol -f memory.raw linux.sockstat

# Loaded kernel modules
vol -f memory.raw linux.lsmod

# Mount points
vol -f memory.raw linux.mount

# Environment variables
vol -f memory.raw linux.envars

macOS Analysis

# Process listing
vol -f memory.raw mac.pslist

# Process tree
vol -f memory.raw mac.pstree

# Network connections
vol -f memory.raw mac.netstat

# Kernel extensions
vol -f memory.raw mac.lsmod

Analysis Workflows

Malware Analysis Workflow

# 1. Initial process survey
vol -f memory.raw windows.pstree > processes.txt
vol -f memory.raw windows.pslist > pslist.txt

# 2. Network connections
vol -f memory.raw windows.netscan > network.txt

# 3. Detect injection
vol -f memory.raw windows.malfind > malfind.txt

# 4. Analyze suspicious processes
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.handles --pid <PID>

# 5. Dump suspicious executables
vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. Extract strings from dumps
strings -a pid.<PID>.exe > strings.txt

# 7. YARA scanning
vol -f memory.raw windows.yarascan --yara-rules malware.yar

Incident Response Workflow

# 1. Timeline of events
vol -f memory.raw windows.timeliner > timeline.csv

# 2. User activity
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.consoles

# 3. Persistence mechanisms
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. Services
vol -f memory.raw windows.svcscan

# 5. Scheduled tasks
vol -f memory.raw windows.scheduled_tasks

# 6. Recent files
vol -f memory.raw windows.filescan | grep -i "recent"

Data Structures

Windows Process Structures

// EPROCESS (Executive Process)
typedef struct _EPROCESS {
    KPROCESS Pcb;                    // Kernel process block
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    // ...
    LIST_ENTRY ActiveProcessLinks;   // Doubly-linked list
    ULONG_PTR UniqueProcessId;       // PID
    // ...
    PEB* Peb;                        // Process Environment Block
    // ...
} EPROCESS;

// PEB (Process Environment Block)
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;
    BOOLEAN ReadImageFileExecOptions;
    BOOLEAN BeingDebugged;           // Anti-debug check
    // ...
    PVOID ImageBaseAddress;          // Base address of executable
    PPEB_LDR_DATA Ldr;              // Loader data (DLL list)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    // ...
} PEB;

VAD (Virtual Address Descriptor)

typedef struct _MMVAD {
    MMVAD_SHORT Core;
    union {
        ULONG LongFlags;
        MMVAD_FLAGS VadFlags;
    } u;
    // ...
    PVOID FirstPrototypePte;
    PVOID LastContiguousPte;
    // ...
    PFILE_OBJECT FileObject;
} MMVAD;

// Memory protection flags
#define PAGE_EXECUTE           0x10
#define PAGE_EXECUTE_READ      0x20
#define PAGE_EXECUTE_READWRITE 0x40
#define PAGE_EXECUTE_WRITECOPY 0x80

Detection Patterns

Process Injection Indicators

# Malfind indicators
# - PAGE_EXECUTE_READWRITE protection (suspicious)
# - MZ header in non-image VAD region
# - Shellcode patterns at allocation start

# Common injection techniques
# 1. Classic DLL Injection
#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. Process Hollowing
#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC Injection
#    - QueueUserAPC targeting alertable threads

# 4. Thread Execution Hijacking
#    - SuspendThread + SetThreadContext + ResumeThread

Rootkit Detection

# Compare process lists
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt  # Hidden processes

# Check for DKOM (Direct Kernel Object Manipulation)
vol -f memory.raw windows.callbacks

# Detect hooked functions
vol -f memory.raw windows.ssdt  # System Service Descriptor Table

# Driver analysis
vol -f memory.raw windows.driverscan
vol -f memory.raw windows.driverirp

Credential Extraction

# Dump hashes (requires hivelist first)
vol -f memory.raw windows.hashdump

# LSA secrets
vol -f memory.raw windows.lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump

# Mimikatz-style extraction
# Requires specific plugins/tools

YARA Integration

Writing Memory YARA Rules

rule Suspicious_Injection
{
    meta:
        description = "Detects common injection shellcode"

    strings:
        // Common shellcode patterns
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // Function prologue
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // Push hash, call

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}

Scanning Memory

# Scan all process memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar

# Scan specific process
vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# Scan kernel memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel

String Analysis

Extracting Strings

# Basic string extraction
strings -a memory.raw > all_strings.txt

# Unicode strings
strings -el memory.raw >> all_strings.txt

# Targeted extraction from process dump
vol -f memory.raw windows.memmap --pid 1234 --dump
strings -a pid.1234.dmp > process_strings.txt

# Pattern matching
grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt

FLOSS for Obfuscated Strings

# FLOSS extracts obfuscated strings
floss malware.exe > floss_output.txt

# From memory dump
floss pid.1234.dmp

Best Practices

Acquisition Best Practices

Minimize footprint : Use lightweight acquisition tools
Document everything : Record time, tool, and hash of capture
Verify integrity : Hash memory dump immediately after capture
Chain of custody : Maintain proper forensic handling

Analysis Best Practices

Start broad : Get overview before deep diving
Cross-reference : Use multiple plugins for same data
Timeline correlation : Correlate memory findings with disk/network
Document findings : Keep detailed notes and screenshots
Validate results : Verify findings through multiple methods

Common Pitfalls

Stale data : Memory is volatile, analyze promptly
Incomplete dumps : Verify dump size matches expected RAM
Symbol issues : Ensure correct symbol files for OS version
Smear : Memory may change during acquisition
Encryption : Some data may be encrypted in memory

Weekly Installs

3.5K

Repository

wshobson/agents

GitHub Stars

32.2K

First Seen

Jan 20, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykWarn

Installed on

claude-code2.7K

gemini-cli2.7K

opencode2.7K

cursor2.6K

codex2.6K

github-copilot2.3K

网站审计工具 - 使用 squirrelscan CLI 全面检测 SEO、性能、安全及技术问题

39,100 周安装

内存取证技术指南：Volatility 3 实战与恶意软件分析工具

🇨🇳中文介绍

内存取证

内存获取

实时获取工具

Windows

Linux

macOS

虚拟机内存

Volatility 3 框架

安装与设置

相关 Skills

核心插件

进程分析

网络分析

DLL 与模块分析

内存注入检测

注册表分析

文件系统证据

Linux 分析

macOS 分析

分析工作流

恶意软件分析工作流

事件响应工作流

数据结构

Windows 进程结构

VAD (虚拟地址描述符)

检测模式

进程注入指标

Rootkit 检测

凭据提取

YARA 集成

编写内存 YARA 规则

扫描内存

字符串分析

提取字符串

使用 FLOSS 分析混淆字符串

最佳实践

获取最佳实践

分析最佳实践

常见陷阱

🇺🇸English

Memory Forensics

Memory Acquisition

Live Acquisition Tools

Windows

Linux

macOS

Virtual Machine Memory

Volatility 3 Framework

Installation and Setup

Essential Plugins

Process Analysis

Network Analysis

DLL and Module Analysis

Memory Injection Detection

Registry Analysis

File System Artifacts

Linux Analysis

macOS Analysis

Analysis Workflows

Malware Analysis Workflow

Incident Response Workflow

Data Structures

Windows Process Structures

VAD (Virtual Address Descriptor)

Detection Patterns

Process Injection Indicators

Rootkit Detection

Credential Extraction

YARA Integration

Writing Memory YARA Rules

Scanning Memory

String Analysis

Extracting Strings

FLOSS for Obfuscated Strings

Best Practices

Acquisition Best Practices

Analysis Best Practices

Common Pitfalls