Running processes can be listed with mac_pslist: $ vol.py -plugins=./profiles -profile=MacMountainLion_10_8_1_AMD圆4 -f file.dmp mac_pslist Probably the first thing you should look for are suspicious processes.
Xenoverse 2 mod installer xv2skillcreat virus mac#
$ vol.py -plugins=./profiles -profile=MacMountainLion_10_8_1_AMD圆4 -f file.dmp mac_versionįrom now on, all Volatility’s mac plugins can be used, list them if you need a reminder: $ vol.py -plugins=./profiles -profile=MacMountainLion_10_8_1_AMD圆4 -f file.dmp -h | grep "mac_"
Place it in a folder and for the next commands, use it as such: $ ls profiles/ If not you will have to build it yourself (reference here). If you are lucky, there is an available profile for the MacOS version you determined on this repository. With that information, we will be able to get a corresponding OS profile for Volatility. Also, if you have or get an account on Apple’s devs website, you can search the development kits page. Build number can be googled to confirm it. There are several occurences of 10.8, which is “Mountain Lion” (see here). However, version can be found in a string on the system: $ grep -Eao "Version +.+ \(+\)" file.dmp While there is a nice way of doing it when you have previous access to the system you are investigating on volatility’s page, that is not possible when the only things you are provided is a dump and no information. Next, I will probably dump someone’s mac (as I do not possess one) to see if I can get my hands on a more recent version of the OS. In this serie of posts there are some commands, guidelines and tricks I could not find while doing it with volatility on the memory dump. I recently came to investigate on a MacOS memory dump and raw disk.
0 kommentar(er)
