# Volatility 3 Plugin Reference Comprehensive reference for Volatility 3 plugins organized by category, with usage examples and output interpretation guidance. ## General Usage ```bash # Basic syntax vol -f [options] # JSON output vol -f -r json # CSV output vol -f -r csv # Filter by PID vol -f --pid ``` ## System Information ### windows.info / linux.info / mac.info Displays OS version, build, and architecture information from the memory dump. ```bash vol -f memory.raw windows.info ``` **Key output fields:** - `NTBuildLab`: Windows build string - `CSDVersion`: Service pack level - `KdDebuggerDataBlock`: Kernel debugger data address - `NtSystemRoot`: System root path - `Time (UTC)`: Dump timestamp **Use for:** Confirming OS version, selecting correct symbol tables, establishing timeline. --- ## Process Analysis ### windows.pslist / linux.pslist / mac.pslist Lists processes from the active process linked list (EPROCESS doubly-linked list on Windows). ```bash vol -f memory.raw windows.pslist vol -f memory.raw windows.pslist --pid 4,1234 vol -f memory.raw windows.pslist --dump ``` **Key output fields:** - `PID`: Process ID - `PPID`: Parent Process ID - `ImageFileName`: Process executable name - `CreateTime`: Process start time - `ExitTime`: Process exit time (if terminated) - `Threads`: Number of threads - `Handles`: Number of handles - `Wow64`: Whether 32-bit process on 64-bit OS **Limitations:** Will not show processes hidden via DKOM (Direct Kernel Object Manipulation). ### windows.psscan Scans physical memory for `EPROCESS` structures using pool tag scanning. Finds terminated and hidden processes. ```bash vol -f memory.raw windows.psscan ``` **When to use:** Always run alongside `pslist`. Processes in `psscan` but not `pslist` are either terminated or hidden by a rootkit. ### windows.pstree Displays the process tree showing parent-child relationships. ```bash vol -f memory.raw windows.pstree ``` **What to look for:** - `cmd.exe` or `powershell.exe` spawned by `explorer.exe` (normal user activity) - `cmd.exe` spawned by `winword.exe` or `excel.exe` (suspicious - macro execution) - `svchost.exe` not a child of `services.exe` (suspicious) - Orphaned processes (PPID points to non-existent process) ### windows.cmdline Displays the command-line arguments for each process. ```bash vol -f memory.raw windows.cmdline vol -f memory.raw windows.cmdline --pid 1234 ``` **What to look for:** - Encoded PowerShell commands (`-EncodedCommand`, `-e`, `-enc`) - Suspicious paths in arguments (Temp, AppData) - Known malware command-line patterns - LOLBins with unusual arguments ### windows.envars Displays environment variables for each process. ```bash vol -f memory.raw windows.envars vol -f memory.raw windows.envars --pid 1234 ``` --- ## Memory Analysis ### windows.malfind Finds potentially injected code by looking for memory regions with suspicious characteristics. ```bash vol -f memory.raw windows.malfind vol -f memory.raw windows.malfind --pid 1234 vol -f memory.raw windows.malfind --dump ``` **Detection criteria:** - `PAGE_EXECUTE_READWRITE` or `PAGE_EXECUTE_WRITECOPY` protection - VAD tagged as `VadS` (private memory) containing executable code - Non-image memory regions with MZ headers (process hollowing) **Output interpretation:** - `Protection: PAGE_EXECUTE_READWRITE` - Most suspicious, legitimate code rarely needs this - Hex dump starting with `4d 5a` (MZ) indicates injected PE - Small regions (< 4KB) with shellcode patterns ### windows.vadinfo Displays Virtual Address Descriptor tree for a process, showing all memory regions. ```bash vol -f memory.raw windows.vadinfo --pid 1234 ``` **Key fields:** - `Start`/`End`: Virtual address range - `Protection`: Memory protection flags - `Tag`: VAD type tag (Vad, VadS, VadF, VadI) - `Filename`: Mapped file (if memory-mapped) ### windows.memmap Shows the memory map for a process and optionally dumps memory. ```bash vol -f memory.raw windows.memmap --pid 1234 --dump ``` --- ## DLL and Module Analysis ### windows.dlllist Lists loaded DLLs for processes from the PEB (Process Environment Block). ```bash vol -f memory.raw windows.dlllist vol -f memory.raw windows.dlllist --pid 1234 ``` **What to look for:** - DLLs loaded from non-standard paths - DLLs with names mimicking system DLLs - Unusually small DLLs (potential shellcode loaders) - DLLs without full paths (side-loading indicators) ### windows.ldrmodules Cross-references module lists from three PEB lists: InLoadOrder, InInitOrder, InMemOrder. ```bash vol -f memory.raw windows.ldrmodules --pid 1234 ``` **Output interpretation:** - All three `True`: Normal loaded module - `False` in one or more lists: Potentially unlinked/hidden module - All `False` but present in memory: Injected or manually mapped DLL ### windows.modules / linux.lsmod Lists loaded kernel modules/drivers. ```bash vol -f memory.raw windows.modules vol -f memory.raw linux.lsmod ``` --- ## Network Analysis ### windows.netscan Scans for network connection structures in memory. ```bash vol -f memory.raw windows.netscan ``` **Key output fields:** - `Proto`: Protocol (TCP/UDP/TCPv6/UDPv6) - `LocalAddr`/`LocalPort`: Local endpoint - `ForeignAddr`/`ForeignPort`: Remote endpoint - `State`: Connection state (ESTABLISHED, LISTENING, CLOSE_WAIT, etc.) - `PID`: Owning process ID - `Owner`: Process name - `Created`: Connection creation time **What to look for:** - ESTABLISHED connections to external IPs from unexpected processes - LISTENING on unusual ports - Connections from processes that normally do not use the network - Multiple connections to the same foreign IP ### linux.sockstat Lists open sockets on Linux systems. ```bash vol -f memory.raw linux.sockstat ``` --- ## Kernel Analysis ### windows.ssdt Displays the System Service Descriptor Table, which maps system call numbers to handler addresses. ```bash vol -f memory.raw windows.ssdt ``` **Interpretation:** All entries should point to addresses within `ntoskrnl.exe` or `win32k.sys`. Entries pointing elsewhere indicate SSDT hooking (rootkit technique). ### windows.callbacks Lists registered kernel callback routines. ```bash vol -f memory.raw windows.callbacks ``` **Callback types to watch:** - `PsSetCreateProcessNotifyRoutine`: Process creation monitoring - `PsSetCreateThreadNotifyRoutine`: Thread creation monitoring - `PsSetLoadImageNotifyRoutine`: Image load monitoring - `CmRegisterCallback`: Registry activity monitoring - `ObRegisterCallbacks`: Object access monitoring ### windows.driverscan Scans for driver objects in memory. ```bash vol -f memory.raw windows.driverscan ``` **What to look for:** - Drivers loaded from non-standard paths - Drivers with no associated file on disk - Drivers with suspicious names --- ## Handle and Object Analysis ### windows.handles Lists handle table entries for processes. ```bash vol -f memory.raw windows.handles vol -f memory.raw windows.handles --pid 1234 ``` **Important handle types:** | Type | Malware Use | |------|-------------| | `Mutant` | Single-instance mutex (campaign marker) | | `File` | Accessed/created files | | `Key` | Registry key access | | `Process` | Process manipulation (injection target) | | `Thread` | Thread manipulation | | `Section` | Shared memory | | `Event` | Synchronization | | `Directory` | Object directory access | --- ## Service Analysis ### windows.svcscan Scans for Windows service records in memory. ```bash vol -f memory.raw windows.svcscan ``` **Key fields:** - `Name`: Service name - `DisplayName`: Service display name - `Type`: SERVICE_WIN32_OWN_PROCESS, SERVICE_KERNEL_DRIVER, etc. - `State`: Running, Stopped, etc. - `Binary`: Service binary path - `Start`: Start type (Boot, System, Auto, Manual, Disabled) **What to look for:** - Services with binary paths pointing to temp/user directories - Kernel driver services loading unsigned drivers - Services with random-looking names - Services with modified ImagePath values --- ## Filesystem Analysis ### windows.filescan Scans for file objects in memory. ```bash vol -f memory.raw windows.filescan ``` ### windows.dumpfiles Extracts files from memory based on file object references. ```bash vol -f memory.raw windows.dumpfiles --pid 1234 vol -f memory.raw windows.dumpfiles --virtaddr 0xfa8001234560 ``` --- ## Registry Analysis ### windows.registry.hivelist Lists registry hives loaded in memory. ```bash vol -f memory.raw windows.registry.hivelist ``` ### windows.registry.printkey Prints registry keys and values. ```bash vol -f memory.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run" ``` **Persistence locations to check:** - `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` - `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce` - `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` - `HKLM\System\CurrentControlSet\Services` - `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` --- ## Linux-Specific Plugins ### linux.bash Recovers bash command history from memory. ```bash vol -f memory.raw linux.bash ``` ### linux.elfs Lists ELF binaries loaded in process memory. ```bash vol -f memory.raw linux.elfs ``` ### linux.check_syscall Checks for system call table hooks. ```bash vol -f memory.raw linux.check_syscall ``` ### linux.check_modules Checks for hidden kernel modules. ```bash vol -f memory.raw linux.check_modules ``` ### linux.tty_check Checks for TTY hook functions. ```bash vol -f memory.raw linux.tty_check ``` --- ## Performance Tips 1. **Use PID filters** to reduce analysis time: `--pid 1234,5678` 2. **JSON output** (`-r json`) is better for automated processing 3. **Large dumps (16GB+)** may need increased timeout values 4. **Symbol tables**: Ensure correct ISF files are available for the target OS version 5. **Parallel execution**: Run independent plugins simultaneously 6. **SSD storage**: Memory dumps on SSD dramatically improve analysis speed