ProfileGenerator
An automated solution to generate profile for memory forensic and virtual machine introspection
Still in development
- The current version is an initial prototype with basic functionalities.
- Need to come up with a better name
Getting started
Prerequisites
-
Linux-amd64 (Tested on Ubuntu 16.04)
-
SWI-prolog:
$ sudo apt-get install swi-prolog
-
PySwip:
$ pip install pyswip
Installing
$ git clone https://github.com/enlighten5/ProfileGenerator.git
and ready to go
Running the test
Test image
This tool is tested on several Debian and Ubuntu systems, with Linux kernel from 2.6 to 5.4.
One test image (lede-4.4.50.bin) can be found here:
$ wget https://cluster.hpcc.ucr.edu/~zqi020/image/lede-4.4.50.bin
Run it
$ cd prolog_engine
$ python prolog_query.py /PATH/TO/TEST/IMAGE
-
The output is saved in
profile.txt
, runpython aggregrate.py
to parse the profile. -
To create a Volatility profile, simple replace the generated fields in a existing profile. This can be done automatically in the future.
Features
- Auto-locate kernel page table.
- Resilient against KASLR
- Auto-generate profiles directly from raw memory dumps
License
This project is under the GPLv3 license. See LICENSE for details
Acknowledgment
- Some of the functions are from Volatility: https://github.com/volatilityfoundation/volatility.git
- SWI-prolog: https://www.swi-prolog.org/
- PySwip: https://github.com/yuce/pyswip.git
- Hat tip to anyone whose code was used.