Tool Setup

Index

Environment

Most of the analysis is performed from the command line. Exact hardware is not important; the relevant part is that the tools and commands shown in the writeups are run on a modern 64-bit Linux system.

All the setup guides will be for Ubuntu/Debian because that is the most common setup used for CTFs and most tools support it natively. I would recommend using a Kali Linux VM simply because that removes a significant amount of hassle from installing the tools.

Forensics

Volatility3

Creator guide:
github.com/volatilityfoundation

Choose the directory you will use volatility 3 in

mkdir volatility
cd volatility

Setup python virtual environment

python -m venv .venv

Activate the environment

source .venv/bin/activate

Install volatility3

pip install volatility3

Check usage

❯ vol
Volatility 3 Framework 2.28.0
usage: vol [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND]
           [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q] [-f FILE]
           [--write-config] [--save-config SAVE_CONFIG] [--clear-cache]
           [--cache-path CACHE_PATH] [--offline | -u URL] [--filters FILTERS]
           [--hide-columns [HIDE_COLUMNS ...]] [-r RENDERER]
           [--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
           [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
           PLUGIN ...
vol: error: Please select a plugin to run (see 'vol --help' for options

MemProcFS

Creator guide:
github.com/ufrisk/MemProcFS

MemProcFS is also available on the LeechCore library.

MemProcFS is dependent on packages, install them.

sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev libfuse2 libfuse-dev lz4 liblz4-dev

Set up the build directory.

mkdir build
cd build

Clone LeechCore and MemProcFS into the same directory.

git clone https://github.com/ufrisk/LeechCore
git clone https://github.com/ufrisk/MemProcFS

First build LeechCore.

cd LeechCore/leechcore
make

Then build MemProcFS vmm.so.

cd ../../MemProcFS/vmm
make

Then build the MemProcFS FUSE.

cd ../memprocfs
make

Then get the link for the latest info.db from https://github.com/ufrisk/MemProcFS/releases/latest. Download it next to the memprocfs binary.

cd ../files
wget https://github.com/ufrisk/MemProcFS/releases/download/v5.18/info.db

Mount your memory dump.

./memprocfs -device <your_dumpfile_or_device> -mount <your_full_mount_point>

You can read more about how to use MemProcFS on their Wiki.