Freebsd 8.4 support #678
Freebsd 8.4 support #678
Conversation
This change adds support for at least FreeBSD 8.4.0, but other old versions might work as well. Included changes: - support for pmap structure without pm_cr3 member (before 9.3) - support for filedesc structure with fd_ofiles member of type `struct file **` (before 9.2) - support for cdev structure with si_name member of type `char *` (before 9.1)
Adds an inital version of freebsd_tcpconns command, which allows to list active TCP connections. This plugin is based on the following publication: Bond, Elyse, "Creating Volatility Support for FreeBSD" (2015). University of New Orleans Theses and Dissertations. 2033.
Also includes a check for missing tcbinfo symbol in tcpconns command.
|
@patriknisen Thanks for your patches. We were hoping to confirm the functionality before merging, but we don't have a profile or 8.4 memory dump handy. Would you be able to share the profile you've been testing with? |
Define which FreeBSD versions introduced 2 structures that are not available in 8.4.
|
FreeBSD-8.4 profile, memory snapshot from vanilla FreeBSD 8.4 is attached. We also improved the module.c so that it can be directly used in older FreeBSD. |
|
Thank you! Nice work on the blog too, I'm just going to paste it here so we have a set of resources for people to reference in one place. https://www.nixu.com/blog/memory-forensics-against-citrix-adc |
|
Hey guys! great work, could you make some instruction manual also so that we will use it properly, for now i have created the profile and im trying to load the raw memory but i get multiple "No base address space" |
We have created the memory dumps by taking a snapshot of the virtual machine running FreeBSD/Netscaler. Are you having trouble acquiring the memory image or analyzing it? After getting the memory image it is just giving the correct parameters for volatility, i.e.: python vol.py -f ~/vmware/FreeBSD/FreeBSD-Snapshot1.vmem --profile FreeBSD-8_4-amd64 freebsd_tcpconns |
4 participants
Adds support for FreeBSD 8.4.0 and probably some other older FreeBSD versions. In addition, implements an initial version of a command for listing TCP connections.