python3 vol.py -f ../../Snapshot6.vmem windows.info Volatility 3 Framework 2.5.2 WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. Snapshot6.vmem and Snapshot6.vmss. Progress: 100.00 PDB scanning finished Variable Value
Kernel Base 0xf80002a59000 DTB 0x187000 Symbols file:///home/mikannse/%E6%A1%8C%E9%9D%A2/tools/volatility3/volatility3/symbols/windows/ntkrnlmp.pdb/3844DBB920174967BE7AA4A2C20430FA-2.json.xz Is64Bit True IsPAE False layer_name 0 WindowsIntel32e memory_layer 1 FileLayer KdDebuggerDataBlock 0xf80002c4a0a0 NTBuildLab 7601.17514.amd64fre.win7sp1_rtm. CSDVersion 1 KdVersionBlock 0xf80002c4a068 Major/Minor 15.7601 MachineType 34404 KeNumberProcessors 1 SystemTime 2020-12-27 06:20:05 NtSystemRoot C:\Windows NtProductType NtProductWinNt NtMajorVersion 6 NtMinorVersion 1 PE MajorOperatingSystemVersion 6 PE MinorOperatingSystemVersion 1 PE Machine 34404 PE TimeDateStamp Sat Nov 20 09:30:02 2010
因为涉及到密码，那就用hashdump
python3 vol.py -f ../../Snapshot6.vmem hashdump Volatility 3 Framework 2.5.2 WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. Snapshot6.vmem and Snapshot6.vmss. Progress: 100.00 PDB scanning finished User rid lmhash nthash
python2 vol.py -f ~/桌面/Snapshot19.vmem imageinfo Volatility Foundation Volatility Framework 2.6.1 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418 AS Layer1 : WindowsAMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/home/mikannse/桌面/Snapshot19.vmem) PAE type : No PAE DTB : 0x187000L KDBG : 0xf80002bfd0a0L Number of Processors : 1 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xfffff80002bfed00L KUSER_SHARED_DATA : 0xfffff78000000000L Image date and time : 2020-12-27 23:06:01 UTC+0000 Image local date and time : 2020-12-28 00:06:01 +0100
python2 vol.py -f ~/桌面/Snapshot19.vmem --profile=Win7SP1x64 shutdowntime Volatility Foundation Volatility Framework 2.6.1 Registry: SYSTEM Key Path: ControlSet001\Control\Windows Key Last updated: 2020-12-27 22:50:12 UTC+0000 Value Name: ShutdownTime Value: 2020-12-27 22:50:12 UTC+0000
python2 vol.py -f ~/桌面/Snapshot14.vmem imageinfo Volatility Foundation Volatility Framework 2.6.1 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418 AS Layer1 : WindowsAMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (/home/mikannse/桌面/Snapshot14.vmem) PAE type : No PAE DTB : 0x187000L KDBG : 0xf80002c4d0a0L Number of Processors : 1 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xfffff80002c4ed00L KUSER_SHARED_DATA : 0xfffff78000000000L Image date and time : 2020-12-27 13:41:31 UTC+0000 Image local date and time : 2020-12-27 05:41:31 -0800
python2 vol.py -f ~/桌面/Snapshot14.vmem --profile=Win7SP1x64 truecryptpassphrase Volatility Foundation Volatility Framework 2.6.1 Found at 0xfffff8800512bee4 length 11: forgetmenot
