May 102015
Whilst messing around with malware, memory dumps, and memory forensics, it is kind of handy to be able to use VirtualBox. Particularly when that is your virtual machine "weapon of choice".
According to the documentation, Volatility can read core dumps from VirtualBox. Once you realise that you need to specify a “profile” to read the result, this is quite simple :-
✓ mike@pica» VBoxManage list vms | grep Windows
"Windows" {9cefc95e-eaf2-4052-b466-cb665c73a36a}
✓ mike@pica» VBoxManage debugvm "Windows" dumpguestcore --filename ~/windows.elf
✓ mike@pica» ls -l ~/windows.elf
-rw------- 1 mike mike 2.1G May 10 14:11 /home/mike/windows.elf
If you specify the right profile option, then Volatility can make use of this :-
✓ mike@pica» volatility -f ~/windows.elf --profile=Win7SP1x86 cmdline
Volatility Foundation Volatility Framework 2.4
************************************************************************
System pid: 4
************************************************************************
smss.exe pid: 260
Command line : \SystemRoot\System32\smss.exe
{Long list of processes removed}
All fairly obvious really, but if you do not specify the profile, volatility will present you an error that indicates it does not understand the format of the memory dump which is a bit confusing :-
✓ mike@pica» volatility -f ~/windows.elf cmdline
Volatility Foundation Volatility Framework 2.4
No suitable address space mapping found
Tried to open image as:
{Long list of memory image formats}
At least to someone as thick as me! Yes it took me ages to get this figured out.