[banderas20]

Hi.

I have a Windows memory dump and I am analyzing it with Volatility.

I have seen many interesting processes. However, I would need to get some live data regarding these processes.
Such as linked Paths, opened documents, passwords entered, and so on.

¿How can achieve this?

Many thanks!

[CyberStrike]

Live data? Umm it's not live anymore it's a snapshot of memory, that said with nothing more than strings and grep you can extract passwords, and volatility does have plugins for that. You will probably use foremost and or scapel to extract documents and files, you can use even a hexeditor for this.

[~Chester~]

pciscreamer

mounts live memory as a file system

[CyberStrike]

pciscreamer

mounts live memory as a file system

Just looked this up interesting way of doing it, well done sir.

[Sitrep]

Are you sure that you have a memory dump and not a ".pcap" (wireshark) network logg?

[~Chester~]

Just looked this up interesting way of doing it, well done sir.

yea its really cool to use. kinda flakey, but can be insanely useful for DMA based game cheats.

[Asdethprime]

https://docs.microsoft.com/en-gb/windows...iveprocess


That’s the official way to do it.

[banderas20]

pciscreamer

mounts live memory as a file system

I can't seem to find that software.

The thing is, I have a memory dump in which appears the process "Truecrypt.exe" and a mounted volume, and I want to find the key.

I issue:

volatility truecryptmaster
volatility truecryptsummary
volatility truecryptpassphrase

The 2 firsts give me results, but the last one yields no results. I expect to find the key that must be stored somewhere in memory.

¿How can I achieve that?

Thanks!

[~Chester~]

I can't seem to find that software.

The thing is, I have a memory dump in which appears the process "Truecrypt.exe" and a mounted volume, and I want to find the key.

I issue:

volatility truecryptmaster
volatility truecryptsummary
volatility truecryptpassphrase

The 2 firsts give me results, but the last one yields no results. I expect to find the key that must be stored somewhere in memory.

¿How can I achieve that?

Thanks!

pciescreamer isnt a software. its an fpga board you plug into one of your free pcie slots and it intercepts bus traffic. It does bundle with a software that will allow you to mount the memory system as an "explorer" type drive.

if you are referring to an attack to grab an encryption key stored in memory, afaik the only way to do this is with subzero temperatures on the affected ram chip then dumping memory.

Heres some info(see page 73):
https://www.uvm.edu/~ddeutl/TOEC2010/Tru...0Guide.pdf

[Asdethprime]

You are trying to find a fully automated way of extracting keys ( private keys) from a programs RAM... BRA!!

They don't always work that way.