# Memory Forensics

### Memory Structure:

{% embed url="<https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-part-4-16c47b89e826>" %}

| Name                | Purpose                                                                                                                                                                                                   | Evil                                                                               |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| KDBG                | Points to EPROCESS block.                                                                                                                                                                                 |                                                                                    |
| EPROCESS:           | <p>Executive Block Process.<br></p><p>Each process has their own EPROCESS and it points to objects that were loaded by the PEB.</p>                                                                       |                                                                                    |
| PEB:                |                                                                                                                                                                                                           |                                                                                    |
| VAD Tree            | Kernel level. Contains DLLs mapped.                                                                                                                                                                       |                                                                                    |
| Private Memory      | Sole memory domain of the target process. Only READWRITE privs should be in here, which makes sense for items being read and written into the stack, heap, and data files.                                | No executables like EXEs or DLLs should be in here. Nor should EXECUTE privileges. |
| Sharable Memory     | <p>Also known as mapped memory and is responsible for mapping all or part of shared files for use by process. Files like .dat and .mui are usually present here. </p><p><br>Expected privs: READONLY </p> | Unexpected: EXECUTE privs                                                          |
| Image Mapped Memory | <p>Part of sharable memory. Expected to see DLLs, EXEs, and drivers mapped here.<br><br>Expected Privs: EXECUTE\_WRITECOPY<br>EXECUTE\_READ</p>                                                           | Unexpected Privs: EXECUTE\_READWRITE                                               |

| Name      | Contains                                                                                                                                                                                                                                                                                                            |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| EPROCESS: | <ul><li>Name of process executable (image file name)</li><li>PID</li><li>PPID</li><li>Location in mem (offset)</li><li>Creation time</li><li>Termination time (exit)</li><li>Threads assigned to process</li><li>Handles to other OS artifacts</li><li>Link to the VAD tree</li><li>Link to the PEB block</li></ul> |
|           |                                                                                                                                                                                                                                                                                                                     |
|           |                                                                                                                                                                                                                                                                                                                     |

<figure><img src="/files/3QWYtfnuImfwVTXbl2XO" alt=""><figcaption></figcaption></figure>

**Considerations:**

* .**24%** of Priviate Memory, .**014%** of sharable memory, and .**01%** of image memory contain **RWX** memory pages.
* **.62%** Priviate, .**036%** sharable, **17.5%** image contain **RX** memory pages.

<figure><img src="/files/mAk2Y511ZjvucdJqmS0d" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/4jo7dkZ2emWkvsjBLISq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/stIl2m6IqFKyutmcM4lz" alt=""><figcaption></figcaption></figure>

## Volatility Enumeration

{% embed url="<https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-823d72d4d7b8>" %}

<figure><img src="/files/Hmcsi2bz9ZJTZRrNHeNq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/g1N2tmsvcCYJpky8eDW0" alt=""><figcaption></figcaption></figure>

### Vol.py Cheatsheet:

```bash
#Enumerate active and closed network sockets
vol2.py -f base-rd01-memory.img --profile=Win10x64_16299 netscan | egrep -i 'CLOSE|ESTABLISHED|Offset'
vol.py -f base-rd01-memory.img windows.netscan

#List handles with files and keys
vol.py -f base-rd01-memory.img windows.handles --pid 5848 | egrep 'File|Key'

#Get sids of specific user
vol.py -f base-rd01-memory.img windows.getsids | grep -i spsql

#List command line
vol.py -f base-rd01-memory.img windows.cmdline

#Psscan output to file
vol.py -f base-rd01-memory.img -r pretty windows.pstree > pstree.txt
```

### Idrmodules:

{% embed url="<https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-part-2-4f45022fb1f8>" %}

<figure><img src="/files/7lVkff1epUq6mKt1y61c" alt=""><figcaption></figcaption></figure>

Note: The base 0x100000 with InInit being "Flase" is present in all memory dumps. That is the process executable and it will not be present in the InInit list, but it should be present in the MapepdPath list. The absence of the image path in MappedPath is suspicious.

### Hide Processes:

{% embed url="<https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/manipulating-activeprocesslinks-to-unlink-processes-in-userland>" %}

<figure><img src="/files/OEtp8IBDATbenkBQf9Gs" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/BcahqFWvk3GHcKBQ7uti" alt=""><figcaption></figcaption></figure>

### Hunting for Handles:

{% embed url="<https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-part-5-a-2368187685e>" %}

## MemProc\_FS

{% embed url="<https://github.com/ufrisk/MemProcFS/wiki>" %}
Directory Explanations
{% endembed %}

### Hunting for injection/FindEvil:

<figure><img src="/files/4vSYBpZNZbUg8NH1tHzk" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/xsktqUNhKkEtxxmFZZZC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/qDswVEFfvZ4e6yNatp7y" alt=""><figcaption></figcaption></figure>

The PE\_PATCHED is a false positive due to normal memory modifications caused by 32-bit code (SysWOW64) execution.

<figure><img src="/files/hnPO0m2sNXV1lp5rVnjh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/NoruZmfGEw6S4vvDYsyG" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/f9g61U8mrKAHsTFWAoPU" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Kp37Al1gz03ZiZvApcWU" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/b6AVeHsQgycFYfTaMrM7" alt=""><figcaption></figcaption></figure>

### RootKits:

<figure><img src="/files/fWjCO99bDwXaKQKDE539" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8gJrCyTEOmKt5UqAT9TY" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/xHj3m6VVY0poufolt6uP" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/ZoJeczI2YPUKclBjoFHt" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GE1kMzIhiDUT1J4VDDjB" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/bZJjDNzqTD0oF7M44pv9" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/PabLyV9UWEekHZUyUgHU" alt=""><figcaption></figcaption></figure>

### Extract Memory Objects Volatility

<figure><img src="/files/g20EsL3AfSuKZ0PRCj6u" alt=""><figcaption></figcaption></figure>

### Labs:

{% embed url="<https://moyix.blogspot.com/2008/02/enumerating-registry-hives.html>" %}

{% embed url="<https://medium.com/@andrewss112/cyberdefenders-injector-6984df1e5d79>" %}

{% embed url="<https://medium.com/@andrewss112/windows-memory-forensics-dumpme-cyberdefenders-47b7bb3614b6>" %}

{% embed url="<https://github.com/evild3ad/MemProcFS-Analyzer>" %}

{% embed url="<https://www.slideshare.net/IIJ_PR/super-easy-memory-forensics>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://nk0.gitbook.io/dfir/windows/forensics/memory/memory-forensics.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.