Memory Images

Here's an XP memory image.

Edit 12/3/08: Here are some more XP images



Full Screen

To make it easier for you to sort through the output of Volatility I've written a little perl script to create an html report of running processes, open files and dlls.

This is not finished as there is more information that I would like to correlate from the output of Volatility. But if you are somewhat curious, this is what I have so far: vol2html.pl. You can see an example report here. The output files for this report and the perl script are bundled together here. There is minimal error checking.

To use, first redirect the output of Volatility for pslist, dlllist and files to text files:

./volatility pslist -f mem.dd > pslist.txt
./volatility files -f mem.dd >files.txt
./volatility dlllist -f mem.dd >dlllist.txt

Then feed the perl script these files:

./vol2html.pl -pslist pslist.txt \
-files files.txt -dlllist dlllist.txt

Wireshark lab: 10/22

You will use the following three files for the labs:

rhino.log
rhino2.log
rhino3.log

Download each of these trace files to use with wireshark. For each of these network trace files do the following:

1) Look at the protocol column and write down each unique protocol that you see there.

2) Briefly describe 5 of the protocols from (1) - that is, what do they do/what are they used for? (We have covered a few protocols in class).

3) Use the search bar to see if you can find any image files. Image files often have file headers of JFIF, EXIF or GIF.

4) If you find any image files, write down the IP addresses that are involved in transmitting those files.

Wireshark lab: 10/15

As I wrote earlier, you will have labs on Wed 10/15 and Wed 10/22 in lab 4206N.

You will use the following trace files since you cannot do live capture in the lab.

After you have downloaded the above zip file, extract the contents onto the desktop.

You will do a lab on HTTP. The lab says ``Ethereal'' which is the old name for Wireshark, but the lab is still valid.

Start up Wireshark and open the file called http-ethereal-trace-1 that you extracted onto the desktop by choosing File->Open and then choosing the above file. You will use this file for all of part 1 in the HTTP lab. Each section uses a different trace file read carefully which trace file you need to use (each of the http-ethereal-trace files will be used).

Try to answer as many questions as you can. These will be figured into your grade as extra credit.