---
# System prepended metadata

title: 5. Understanding MEMORY FORENSICS.

---

---
title: 5. Understanding MEMORY FORENSICS.
---

# 1. Learn about some tools used in Memory Forensics such as **Volatility, MemProcFS.**

Memory Forensics is the process to anazly Volatility memory (RAM) to extract information about what a system was doing at given point in time. It is epecially useful in incident response , malware analyze and digital forensic.


## 🔹 Volatility Framework. 

The Volatility Framework has become the world’s most widely used memory forensics tool - relied upon by law enforcement, military, academia, and commercial investigators around the world. The Volatility Foundation helps keep Volatility going so that it may be used in perpetuity, free and open to all.

+ key features
- **Extract the process, network connection , DLL, registry hive, etc.**
- **support plugin for anazly tasks.**
- **python-based,scriptable, and extenable.**

📌 *Common use*
- **finding malware in RAM.**
- **Recover delete files.**
- **Dumping credentials. etc(password and hashes).**
- **Deteching rootkit and hidden process (unsual activities).**

Basic usage:
- `python3 volatility3/vol.py -f 20250312.mem windows.info `
- `python2 volatility/vol.py -f 20250312.mem imageinfo `
📌 *Popular plugin*
- pslist : list active process 
- netscan : scan for hidden process
- dlllist : list load dll
- hashdump : dump password hash from memory

Versions: 

- volatility2 : older and support python2.
- volatility3 : latest and rewrite python3.

Links: https://volatilityfoundation.org/

## 🔹 MemProcFS (Memory Process File System)

MemProcFS is an advanced tools that mount a memory dump as a virtual file system, allowing investigator to browse memory as if it alive file system.

+ key features
- **memory dump is mounted as a virtual FS under /mnt/memfs/**
- **process, memory pages, PE headers, DLL, registry hives can be accessed directly as files**.
- **work on windows and linux**
- **provide an powerfull GUI + CLI**

📌 *Common use case*
- **extract file from memory(exe, pdf and dll)**
- **Analzy malware code directly from memory**
- **intergrating with other tools like ida Pro and ghidra**.
- **Easy access for scripting and automation.**

Example: 
after mounting, you might browse **/mnt/memfs/Process/1234** to see the memory of process with pid.

Link: https://github.com/ufrisk/MemProcFS


## 🔹 Learn how to create volatility profile 2/symbol volatility 3

Learn about virtual address, physical address, process information such as pid, ppid, process name, commandline.

Learn about process dump

Create profile: Ubuntu version < 22.04 using virtual machine (write wu in detail how to do it)
### Download Ubuntu 20.04 LTS 
https://releases.ubuntu.com/20.04/ubuntu-20.04.6-desktop-amd64.iso


Create symbol: Debian using virtual machine (write wu in detail how to do it)



https://youtu.be/EqGoGwVCVwM?si=dq2s1s4xE1meJHhC
Do the following challenges, write wu in detail:
https://github.com/stuxnet999/MemLabs

### MemLabs Lab 0 - Never Too Late Mister
This directory has been created to aid first-timers in learning how to approach a CTF-styled memory forensics challenge and also learn the plugins of the memory analysis framework, Volatility.

So here I'll be writing a very elaborate walkthrough of a memory forensics challenge which I made for the BSides Delhi CTF 2018. The challenge is fairly easy in difficulty and I believe will be a great example challenge for everyone new to this.

Onto the challenge now.

Challenge Description
My friend John is an "environmental" activist and a humanitarian. He hated the ideology of Thanos from the Avengers: Infinity War. He sucks at programming. He used too many variables while writing any program. One day, John gave me a memory dump and asked me to find out what he was doing while he took the dump. Can you figure it out for me?

Challenge file: https://drive.google.com/file/d/1MjMGRiPzweCOdikO3DTaVfbdBK5kyynT/view

![image](https://hackmd.io/_uploads/rJQ_Nemuxl.png)

profile = Win7SP1x86_23418

![image](https://hackmd.io/_uploads/r1vs4lQugl.png)
i see something suspect demon.py 
in order to extract it we have to use consoles
 python2 volatility/vol.py -f Challenge.raw --profile=Win7SP1x86_23418 consoles
![image](https://hackmd.io/_uploads/rkLZIx7uxe.png)

i cann't decode it 
i ask chatgpt to bruteforce it xor
![image](https://hackmd.io/_uploads/Hy_SvlXdle.png)


![image](https://hackmd.io/_uploads/BJ3DDxm_ll.png)
 python2 volatility/vol.py -f Challenge.raw --profile=Win7SP1x86_23418 hashdump
![image](https://hackmd.io/_uploads/H1TdPlmOxe.png)

![image](https://hackmd.io/_uploads/HJ9T9e7_ex.png)

![image](https://hackmd.io/_uploads/HyWFdx7uex.png)
https://hashes.com/en/decrypt/hash

![image](https://hackmd.io/_uploads/S1hjqemulg.png)
flag{you_are_good_but1_4m_b3tt3r}4

### Memlab2 
![image](https://hackmd.io/_uploads/HkTcCfU_xe.png)
python3 volatility3/vol.py -f MemoryDump_Lab1.raw windows.cmdline
![image](https://hackmd.io/_uploads/SJzpAMUuex.png)
python3 volatility3/vol.py -f MemoryDump_Lab1.raw windows.filescan | grep -i important.rar
to see virtual address 
![image](https://hackmd.io/_uploads/HkWZyXIOee.png)
to dump it out 
python3 volatility3/vol.py -f MemoryDump_Lab1.raw windows.dumpfiles --physaddr 0x3fa3ebc0
![image](https://hackmd.io/_uploads/HyRf178dxg.png)
i see flag.png
![image](https://hackmd.io/_uploads/By9E1mU_lx.png)
![image](https://hackmd.io/_uploads/S1Nay7Luee.png)
i see it mention alisa account
![image](https://hackmd.io/_uploads/rkeYlX8del.png)
password: F4FF64C8BAAC57D22F22EDC681055BA6

![image](https://hackmd.io/_uploads/HydOQ7Uuxx.png)
flag{w3ll_3rd_stage_was_easy}



### Memlab2 : https://mega.nz/file/ChoDHaja#1XvuQd49c7-7kgJvPXIEAst-NXi8L3ggwienE1uoZTk
when i check python2 volatility/vol.py -f MemoryDump_Lab2.raw --profil=Win7SP1x64 consoles

it is nothing!!!
![image](https://hackmd.io/_uploads/HJvTpMcuxe.png)

![image](https://hackmd.io/_uploads/r13haf9deg.png)



![image](https://hackmd.io/_uploads/SylWj_POxg.png)
 #### python2 volatility/vol.py -f MemoryDump_Lab2.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000003fce1c70 -D ./dump
 dump password png
 ![image](https://hackmd.io/_uploads/rJ5Ijuvuge.png)
 ![image](https://hackmd.io/_uploads/H1FqoODulg.png)

 flag{w0w_th1s_1s_Th3_SeC0nD_ST4g3_!!}

### Memlab 3
Challenge: https://mega.nz/file/2ohlTAzL#1T5iGzhUWdn88zS1yrDJA06yUouZxC-VstzXFSRuzVg

![image](https://hackmd.io/_uploads/rJ4p1Q9dxe.png)
when i use cmdline i see something suspicious 

![image](https://hackmd.io/_uploads/S1JcOZCdll.png)
![image](https://hackmd.io/_uploads/SydcdbC_el.png)
let dump it out
![image](https://hackmd.io/_uploads/SJwod-COeg.png)

![image](https://hackmd.io/_uploads/BJeh_Z0ugx.png)
i ask chatgpt
![image](https://hackmd.io/_uploads/SJp3_ZRdgg.png)

when i do filescan i see something suspicious 
![photo_2025-08-13_21-40-02](https://hackmd.io/_uploads/ryJgKZCulx.jpg)

Flag: inctf{0n3_h4lf_1s_n0t_3n0ugh}

### Memlabs 4 
challenge: https://mega.nz/file/Tx41jC5K#ifdu9DUair0sHncj5QWImJovfxixcAY-gt72mCXmYrE
python2 volatility/vol.py -f MemoryDump_Lab4.raw --profile=Win7SP1x64 cmdline

![image](https://hackmd.io/_uploads/rJcuCixFge.png)

i see stikynot it probably be malware as i am not good at reverse , i put it back i will take a look next time. 
python2 volatility/vol.py -f MemoryDump_Lab4.raw --profile=Win7SP1x64 filescan > result.txt
and then i flirter and found someting important example , i flirter png , jpg and txt, etc....

![image](https://hackmd.io/_uploads/BJmamoetlg.png)
0x000000003fc398d0     16      0 R--rw- \Device\HarddiskVolume2\Users\SlimShady\Desktop\Important.txt
i see important.txt
![image](https://hackmd.io/_uploads/r1svVslFgg.png)
We can’t extract the file directly
i ask chatgpt
![image](https://hackmd.io/_uploads/BJJZrjetll.png)

Users\\SlimShady\\Desktop\\Important.txt

python2 volatility/vol.py -f MemoryDump_Lab4.raw --profile=Win7SP1x64 mftparser | grep -C 20 'Users\\SlimShady\\Desktop\\Important.txt'
![image](https://hackmd.io/_uploads/rJQU6jxtlg.png)


![image](https://hackmd.io/_uploads/HyE6aixYle.png)
![image](https://hackmd.io/_uploads/SklmRsxtxl.png)


Flag: {1_is_n0t_EQu4l_7o_2_bUt_th1s_d0s3nt_m4ke_s3ns3}


### Memlab5 
Challenge: https://mega.nz/#!Ps5ViIqZ!UQtKmUuKUcqqtt6elP_9OJtnAbpwwMD7lVKN1iWGoec
python2 volatility/vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 cmdline
i see something interesting 
![image](https://hackmd.io/_uploads/BJZCj-7Yxe.png)
python2 volatility/vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 filescan | grep "SW1wb3J0YW50.rar"

![image](https://hackmd.io/_uploads/Hk8RnbmKlg.png)



python2 volatility/vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000003eed56f0 -D dumps
![image](https://hackmd.io/_uploads/B16n2bmFxl.png)
i dont have password
![image](https://hackmd.io/_uploads/B1plTb7txg.png)

in order to find password 
python2 volatility/vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 filescan | grep "png" > result.txt
it didn't work 
i use plugin iehistory

![image](https://hackmd.io/_uploads/Hyw21GXYxx.png)
![image](https://hackmd.io/_uploads/r1kQlfQYge.png)

i got first flag
then i use to first flag as password
![image](https://hackmd.io/_uploads/H1E8eGQtxl.png)


### Memlabs 6
Challenge: https://mega.nz/file/C0pjUKxI#LnedePAfsJvFgD-Uaa4-f1Tu0kl5bFDzW6Mn2Ng6pnM

python2 volatility/vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 pslist
it has many process related with browser.

![image](https://hackmd.io/_uploads/rkmhyLQYgx.png)

i see flag.rar
![image](https://hackmd.io/_uploads/r1LgxLmYll.png)

                                                                                                                                                                                             
┌──(kali㉿kali)-[~/Desktop]
└─$ python2 volatility/vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 filescan  | grep "flag.rar"        
Volatility Foundation Volatility Framework 2.6.1
0x000000005fcfc4b0     16      0 R--rwd \Device\HarddiskVolume2\Users\Jaffa\Desktop\pr0t3ct3d\flag.rar

─$ python2 volatility/vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000005fcfc4b0 -D dumps

![image](https://hackmd.io/_uploads/SyFPxLmYll.png)

![image](https://hackmd.io/_uploads/rkNjgUmtlx.png)

i see something interesting env

![image](https://hackmd.io/_uploads/B1eCx87Kle.png)
python2 volatility/vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 envars

![image](https://hackmd.io/_uploads/ryHb-8QYgg.png)

i see it is second part
![image](https://hackmd.io/_uploads/HyHSG8XKle.png)

 python2 volatility/vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 iehistory > url.txt

i got nothing 
i read write up i know how to solve it
https://hackmd.io/-13wwkEpQXyH0QC207Pc8g
![image](https://hackmd.io/_uploads/Sy3bSU7Yxe.png)
i see pastebin url
![image](https://hackmd.io/_uploads/Hk6HrI7tll.png)
i see url mega
it require key
![image](https://hackmd.io/_uploads/BkXhSImYgg.png)

![image](https://hackmd.io/_uploads/SyBjHUmtel.png)

![image](https://hackmd.io/_uploads/S1qeI8QYll.png)
The key is zyWxCjCYYSEMA-hZe552qWVXiPwa5TecODbjnsscMIU
![image](https://hackmd.io/_uploads/r1Bw8LXtgg.png)

i compare two png 
![image](https://hackmd.io/_uploads/SJZKLUXYel.png)
