volafox

Introduction

volafox a.k.a 'Mac OS X Memory Analysis Toolkit' is developed on python 2.x

please check out our repository for all of features included experiment

License

GNU GPL v2

System Environment

Language: Python 2.x
Architecture: Intel 32/64 bit
Officially supported os: Snow Leopard(10.6), Lion(10.7), Mountain Lion(10.8), Mavericks(10.9), Yosemite(10.10), El Capitan(10.11)

Requirement

Kernel Symbol List
overlay data(Included repo from Snow Leopard to El Capitan)
Memory Image
Raw memory image(Firewire, VMware memory image)
Exported raw memory image using rekal developed by google
- command : rekal aff4export -D . [AFF4 IMAGE] => output filename : Physical Memory
Flatten Mac Memory Reader Format using flatten.py(32bit, 64bit) => MMR doesn't support OS X Mountain Lion above now.

Information

volafox: Mac OS X Memory Analysis Toolkit
project: https://github.com/n0fate/volafox
support: 10.6-11(Snow Leopard ~ El Capitan); 32/64-bit kernel
  input: raw memory image (*.mem or exported raw memory image using rekal developed by google
  -> If you get a AFF4 format, you can export linear memory image as following cmd : rekal aff4export -D . [AFF4 MEMORY IMAGE]

  usage: python vol.py -i IMAGE [-o COMMAND [-vp PID][-x PID][-x KEXT_ID][-x TASKID][-x SYMFILENAME]]

Options:
-o CMD            : Print kernel information for CMD (below)
-p PID            : List open files for PID (where CMD is "lsof" and dumpfile)
-v                : Print all files, including unsupported types (where CMD is "lsof")
-x PID/KID/TASKID/SYMBOLNAME/Virtual ADDRESS :
   Dump process/task/kernel extension address space for PID/KID/Task ID (where CMD is "ps"/"kextstat"/"tasks"/"machdump"/"dumpsym"/"dumpfile")

COMMANDS:
system_profiler : Kernel version, CPU, and memory spec, Boot/Sleep/Wakeup time
mount           : Mounted filesystems
kextstat        : KEXT (Kernel Extensions) listing
kextscan        : Scanning KEXT (Kernel Extensions) (64bit OS only)
ps              : Process listing
tasks           : Task listing (Finding process hiding)
machdump        : Dump macho binary and relocation for analysis
systab          : Syscall table (Hooking detection)
                  => Call Number 427 is bugged not hooked.
mtt             : Mach trap table (Hooking detection)
netstat         : Network socket listing (Hash table)
lsof            : Open files listing by process (research, osxmem@gmail.com)
dumpfile        : Dump a file on Memory (Required -p and -x option)
pestate         : Show Boot information
efiinfo         : EFI System Table, EFI Runtime Services
keychaindump    : Dump master key candidates for decrypting keychain(Lion ~ El Capitan)
dmesg           : Debug message at boot time
uname           : Print a short for unix name(uname)
hostname        : Print a hostname
notifiers       : Detects I/O Kit function hooking
trustedbsd      : Show TrustedBSD MAC Framework
bash_history    : Show history in bash process
sysctl          : show the result like sysctl command
dumpsym         : Dump kernel symbol address considered of KASLR to file (for RCE)

Kernel Rootkit Detection: (testing code by n0fate) - Required Library : distorm3
kdebug_hook     : Examination of the KDebug function code for mal-code detection
kauth_hook      : Examination of the KAUTH for mal-code hiding detection from Anti-virus
bsm_hook        : Examination of auto_commit function on the OpenBSM
fbt_syscall     : Examination of syscall table for hooking by DTrace FBT Provider

volafox for BSD

Experimental - I just keep it for researcher

Introduction

FreeBSD Memory Analysis Toolkit
Tested OS: FreeBSD x86 7.x, 8.x

Requirement*

Kernel Image(kernel)
Memory Image

Information*

KLD list
KLD dump
System call hooking detection
Process list(LIST, HASH) (0.2 beta2<=)
Process dump (HASH)
Network Information (IP, Port, flag) (0.2 beta2<=)
Module list in KLD (0.2 beta1<=)

icon source : www.kaishinlab.com