0

It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3?

The "old way" does not seem to work:

If desired, the plugin can be used to dump contents of process memory. vol.py -f [image] –profile=[profile] -p [PID] –dump-dir=[directory/] The above will dump the entire contents of the process memory to a file in the directory specified by –dump-dir= option.

I tried:

volatility -f mydump.vmem -p 1470 -D procdump

Volatility 3 Framework 1.2.1-beta.1
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
                  [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
                  [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
                  [--write-config] [--clear-cache]
                  [--single-location SINGLE_LOCATION]
                  [--stackers [STACKERS [STACKERS ...]]]
                  [--single-swap-locations [SINGLE_SWAP_LOCATIONS [SINGLE_SWAP_LOCATIONS ...]]]
                  plugin ...
volatility: error: argument plugin: invalid choice procdump (choose from banners.Banners, configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, isfinfo.IsfInfo, layerwriter.LayerWriter, linux.bash.Bash, linux.check_afinfo.Check_afinfo, linux.check_creds.Check_creds, linux.check_idt.Check_idt, linux.check_modules.Check_modules, linux.check_syscall.Check_syscall, linux.elfs.Elfs, linux.keyboard_notifiers.Keyboard_notifiers, linux.lsmod.Lsmod, linux.lsof.Lsof, linux.malfind.Malfind, linux.proc.Maps, linux.pslist.PsList, linux.pstree.PsTree, linux.tty_check.tty_check, mac.bash.Bash, mac.check_syscall.Check_syscall, mac.check_sysctl.Check_sysctl, mac.check_trap_table.Check_trap_table, mac.ifconfig.Ifconfig, mac.kauth_listeners.Kauth_listeners, mac.kauth_scopes.Kauth_scopes, mac.kevents.Kevents, mac.list_files.List_Files, mac.lsmod.Lsmod, mac.lsof.Lsof, mac.malfind.Malfind, mac.mount.Mount, mac.netstat.Netstat, mac.proc_maps.Maps, mac.psaux.Psaux, mac.pslist.PsList, mac.pstree.PsTree, mac.socket_filters.Socket_filters, mac.timers.Timers, mac.trustedbsd.Trustedbsd, mac.vfsevents.VFSevents, timeliner.Timeliner, windows.bigpools.BigPools, windows.cachedump.Cachedump, windows.cmdline.CmdLine, windows.dlllist.DllList, windows.driverirp.DriverIrp, windows.driverscan.DriverScan, windows.envars.Envars, windows.filescan.FileScan, windows.getservicesids.GetServiceSIDs, windows.getsids.GetSIDs, windows.handles.Handles, windows.hashdump.Hashdump, windows.info.Info, windows.lsadump.Lsadump, windows.malfind.Malfind, windows.memmap.Memmap, windows.modscan.ModScan, windows.modules.Modules, windows.mutantscan.MutantScan, windows.netscan.NetScan, windows.poolscanner.PoolScanner, windows.privileges.Privs, windows.pslist.PsList, windows.psscan.PsScan, windows.pstree.PsTree, windows.registry.certificates.Certificates, windows.registry.hivelist.HiveList, windows.registry.hivescan.HiveScan, windows.registry.printkey.PrintKey, windows.registry.userassist.UserAssist, windows.ssdt.SSDT, windows.statistics.Statistics, windows.strings.Strings, windows.symlinkscan.SymlinkScan, windows.vadinfo.VadInfo, windows.virtmap.VirtMap)

EDIT

From andreafortuna -D <directory_path> and --proc-dump <directory_path> are the same and I used ./procdump/ in this example.

Soleil
  • 111
  • 1
  • 5

2 Answers2

4

To dump the whole memory (not only binary itself) of the given process in Volatility 3 you need to use windows.memmap.Memmap plugin with --pid and --dump options as explained here.

For example:

vol.py -f mydump.vmem -o /path/to/output/dir windows.memmap.Memmap --pid 1233 --dump
Oleg Kazakov
  • 41
  • 2
1

Using the latest Python version of Volatility 3 (2.0.0 beta.1), I think you can try this if it is a memory dump from a Windows machine:

vol.py -f mydump.vmem windows.pslist.PsList --pid 1470 --dump

The parameter --dump is quite new.

Volatility 3 Framework 2.0.0-beta.1
usage: volatility windows.pslist.PsList [-h] [--physical]
                                        [--pid [PID [PID ...]]] [--dump]

optional arguments:
  -h, --help            show this help message and exit
  --physical            Display physical offsets instead of virtual
  --pid [PID [PID ...]]
                        Process ID to include (all other processes are
                        excluded)
  --dump                Extract listed processes
swepeba
  • 11
  • 1