Comment on page
Build Custom Linux Profile for Volatility
Build Volatility overlay profile for compromised system (with another version installed, not on the compromised system itself). If you can spin up a virtual machine using a virtual disk/backup/snapshot, or provision a virtual machine using the same kernel, that would be ideal.
In addition to the above, if your EC2 instance is built on a standard AMI, just provision a new instance using the same AMI and install the debug kernel.
Identifying potential kernel candidates and building a specific kernel
You may be in a situation where you have a memory dump, but aren't provided with information about which system it came from, release/build information, kernel information etc.
Using the banners plugin in Volatility3, it's possible to identify potential candidates to assist with building a symbol table.
$ python3 vol.py -f evidence.mem banners
Volatility 3 Framework 2.4.2
Progress: 100.00 PDB scanning finished
Offset Banner
0x738001a0 Linux version 6.2.0-36-generic (buildd@lcy02-amd64-050) (x86_64-linux-gnu-gcc-11 (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #37~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC (Ubuntu 6.2.0-36.37~22.04.1-generic 6.2.16)
0x73975d40 Linux version 6.2.0-36-generic (buildd@lcy02-amd64-050) (x86_64-linux-gnu-gcc-11 (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #37~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 9 15:34:04 UTC 2 (Ubuntu 6.2.0-36.37~22.04.1-generic 6.2.16)
Using this information, deploy an Ubuntu 22.04 virtual machine and use it as a base for our profile.
$ sudo apt update; sudo apt install linux-image-6.2.0-36-generic
Install the corresponding kernel. Reboot. Verify the kernel is installed.
user@ubuntu:~$ uname -a
Linux ubuntu 6.2.0-36-generic #37~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 9 15:34:04 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
We need to install the corresponding debug symbols for our kernel. We'll add an additional repository, update, and install the appropriate debug symbols.
$ sudo nano /etc/apt/sources.list.d/ddebs.list
deb http://ddebs.ubuntu.com xxxxx main restricted universe multiverse
deb http://ddebs.ubuntu.com xxxxx-updates main restricted universe multiverse
deb http://ddebs.ubuntu.com xxxxx-proposed main restricted universe multiverse
(replace xxxxx with your release name from 'lsb_release -cs', ie focal, trusty, etc.
wget -O - http://ddebs.ubuntu.com/dbgsym-release-key.asc | sudo apt-key add -
$ sudo apt update
$ sudo apt install linux-image-6.2.0-36-generic-dbgsym
$ sudo shutdown -r now
Now we need to create a symbol table/profile using dwarf2json
$ git clone https://github.com/volatilityfoundation/dwarf2json.git
$ cd dwarf2json.git
$ go build
(if required, or copy precompiled executable)
$ sudo ./dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-6.2.0-36-generic --system-map /boot/System.map-6.2.0-36-generic > Ubuntu22.04-6.2.0-36-generic.json
The above command should complete successfully. Move the new symbol table to your Volatility3 directory, and run isfinfo to ensure it's registered/cached correctly.
$ mv Ubuntu22.04-6.2.0-36-generic.json /path/to/volatility3/symbols/linux
$ python3 vol.py isfinfo
Volatility 3 Framework 2.4.2
Progress: 100.00 PDB scanning finished
URI Valid Number of base_types Number of types Number of symbols Number of enums Identifying information
<snip>
file:///home/user/volatility3/symbols/linux/Ubuntu22.04-6.2.0-36-generic.json True (cached) 19 12930 263277 2285 b'Linux version 6.2.0-36-generic (buildd@lcy02-amd64-050) (x86_64-linux-gnu-gcc-11 (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #37~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 9 15:34:04 UTC 2 (Ubuntu 6.2.0-36.37~22.04.1-generic 6.2.16)\n\x00'
Test your symbol table with your memory dump to ensure it's functioning correctly
$ python3 vol.py -f evidence.mem linux.pslist
Volatility 3 Framework 2.4.2
Progress: 100.00 Stacking attempts finished
OFFSET (V) PID TID PPID COMM
0x99f7802a1980 1 1 0 systemd
0x99f7802a3300 2 2 0 kthreadd
0x99f7802a6600 3 3 2 rcu_gp
0x99f7802a0000 4 4 2 rcu_par_gp
0x99f7802a4c80 5 5 2 slub_flushwq
0x99f7802b9980 6 6 2 netns
0x99f7802be600 8 8 2 kworker/0:0H
0x99f7802bcc80 10 10 2 mm_percpu_wq
0x99f78033b300 11 11 2 rcu_tasks_kthre
Using dwarf2json to build kernel profiles for Volatility3
For an AmazonLinux EC2 instance (6.1.34-59.116.amzn2023.x84_64)
$ sudo su
$ sudo yum update -y
$ sudo yum --enablerepo='*debuginfo' install kernel-debuginfo-$(uname -r)
$ mkdir /home/ec2-user/volatility3
$ sudo cp /boot/System.map-6.1* /home/ec2-user/volatility3
$ sudo cp /usr/lib/debug/lib/modules/6.1.34-59.116.amzn2023.x86_64/vmlinux /home/ec2-user/volatility3
(grab precompiled version of dwarf2json from this repo https://github.com/kevthehermit/volatility_symbols)
$ wget https://github.com/kevthehermit/volatility_symbols/raw/main/dwarf2json
$ chmod +x dwarf2json
$ ./dwarf2json linux --system-map /path/to/System.map-6.1.34-59.116.amzn2023.x86_64 --elf /path/to/vmlinux > your-name-for-kernel.json
$ cp /path/to/your-name-for-kernel.json /path/to/volatility3/volatility3/symbols/linux
$ python3 vol.py isfinfo (check new profile is registered)
$ python3 vol.py -f ec2mem.mem banners
$ python3 vol.py -f ec2mem.mem linux.pslist
This was the original article for volatility2, using dwarfdump to build an Ubuntu kernel profile.
Download/GitClone volatility
$ cd volatility/tools/linux
$ uname -r
4.15.0-106-generic
$ sudo make -C /lib/modules/4.15.0-106-generic/build/ CONFIG_DEBUG_INFO=y M=$PWD modules
If you receive an error similar to the following, you need to modify module.c
ERROR: modpost: missing MODULE_LICENSE() in /home/USER/volatility/tools/linux/module.o
$ nano module.c
add the following line to the end of the file, exactly as it appears
MODULE_LICENSE("GPL");
If dwarfdump isn't installed, install it
$ sudo apt install dwarfdump
$ dwarfdump -di ./module.o > module.dwarf
$ sudo zip Ubuntu64-4.15.0.106.zip module.dwarf /boot/System.map-4.15.0-106-generic
Move linux profile to Volatility overlays
$ cp Ubuntu64-4.15.0.106.zip /path/to/volatility/plugins/overlays/linux/
Test Volatility
$ python vol.py --info | grep Linux
Test Volatility with profile
$ python vol.py -f /mnt/volatility/DF/vm-dump.mem --profile=LinuxUbuntu64-4_15_0_106x64 linux_pslist
Last modified 10d ago