#volafox

[volafox-blog]

volafox 0.9 release

Download : volafox-0.9

Contact : [email protected] (@n0fate), @osxmem

volafox: Mac OS X Memory Analysis Toolkit

project: http://code.google.com/p/volafox

support: 10.6-9(Snow Leopard ~ Mavericks); 32/64-bit kernel input: *.mem (osxpmem or virtualmachine raw memory file), *.mmr (Mac Memory Reader, flattened x86)

usage: python ./vol.py -i IMAGE [-o COMMAND [-vp PID][-x PID][-x KEXT_ID][-x TASKID]]

Options:

-o CMD : Print kernel information for CMD (below)

-p PID : List open files for PID (where CMD is “lsof”)

-v : Print all files, including unsupported types (where CMD is “lsof”)

-x PID/KID/TASKID : Dump process/task/kernel extension address space for PID/KID/Task ID (where CMD is “ps”/”kextstat”/”tasks”/”machdump”)

COMMANDS:

system_profiler : Kernel version, CPU, and memory spec, Boot/Sleep/Wakeup time

mount : Mounted filesystems

kextstat : KEXT (Kernel Extensions) listing

kextscan : Scanning KEXT (Kernel Extensions) (64bit OS only, experiment)

ps : Process listing

tasks : Task listing (Finding process hiding)

machdump : Dump macho binary (experiment)

systab : Syscall table (Hooking detection)

mtt : Mach trap table (Hooking detection)

netstat : Network socket listing (Hash table)

lsof : Open files listing by process (research, [email protected])

pestate : Show Boot information

efiinfo : EFI System Table, EFI Runtime Services

keychaindump : Dump master key candidates for decrypting keychain(Lion ~ Mavericks)

dmesg : Debug message at boot time

uname : Print a short for unix name(uname)

hostname : Print a hostname

trustedbsd : Show TrustedBSD MAC Framework

bash_history : Show history in bash process

[volafox-blog]

Research on memory forensics for Mac OS X has been conducted over the last couple of years. This paper covers the characteristics of a prevalent piece of Mac malware and diverse analysis techniques based on an ongoing project, Volafox, including general system information view, hidden process detection, hidden KEXT (device driver for Windows) detection, system call and mach trap table hooking detection, and so on. Furthermore, we will deal with efficient rootkit detection methods using memory forensic techniques for Mac.

Hi all,

volafox project will be introduced at Virus Bulletin 2013. It is reserve paper but nice opportunity that show volafox unto malware analyst in world-wide. This paper covers diverse analysis techniques based on memory forensics including hiding process/kext/network session detection, function call table hooking, trustedbsd root kit and so on. For further information, check out the link. ;-)

[volafox-blog]

Update - Jun. 9. 2013

Log

1. mountain lion(10.8.4) overlay has been committed to repository.

2. process(ps) and master key for keychain(keychaindump) dump bug fixed.

[volafox-blog]

Volafox and Chain Breaker will be introduced at CodeGate 2013

n0fate(Core Member, F-INSIGHT) will introduce the volafox and his new tool at CodeGate 2013 (4. April). The topic of the presentation is "keychain analysis from digital forensic perspective". This topic focus on method of more elegant keychain analysis and extracting master key candidates from Mac memory image.

A new tool called the (Key)Chain Breaker. It is powerful analysis toolkit that extracts user credential on keychain. If investigator has disk and memory image, He will get various information (e.g. key, user account generated from application, web autofill data, ssh/ftp account ...) from it.

Chain Breaker will be committed to GitHub or be integrated into the volafox project.

Slide will be uploaded to slideshare or other sharing site after presentation.

See you at the CodeGate 2013 ;-)

[volafox-blog]

volafox support Mac OS X Mountain Lion after revision 94 now.

I'm not sure if it has compatible with 10.8.3. because It doesn't pass my testing course yet. If it has some buggy, please email me. ;-)

[volafox-blog]

volafox a.k.a Mac OS X Memory Forensic Toolkit

volafox project is most famous memory forensic toolkit for Mac OS X. This programs have been developed with the python language. volafox analyze physical memory image on Intel x86 and IA-32e. If you use this tool for digital investigation, you can find information related rootkit and malware. and dump it on your evidence(memory image). volafox project has two programs between volafox(Mac OS X) and volafunx(FreeBSD).