Vedaang/malware_analysis
Malware Analysis Dataset This dataset contains memory forensics analysis data for malware research, including both benign and ransomware samples analyzed with Volatility Framework. Structure Dataset Repository (this repo) Scripts: Volatility automation scripts (Automating_Volatility.py, Volshell_Automation.py, vboxelf.py) YARA Rules: malware_rules.yar for malware detection Scan Results: Lightweight analysis outputs: malfind/ - Process memory… See the full description on the dataset page: https://huggingface.co/datasets/Vedaang/malware_analysis.
038
1# Volatility2# Copyright (C) 2007,2008 Volatile Systems3# Copyright (C) 2005,2006,2007 4tphi Research4#5# Authors: 6# {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)7# phil@teuwen.org (Philippe Teuwen)8#9# This program is free software; you can redistribute it and/or modify10# it under the terms of the GNU General Public License as published by11# the Free Software Foundation; either version 2 of the License, or (at12# your option) any later version.13#14# This program is distributed in the hope that it will be useful, but15# WITHOUT ANY WARRANTY; without even the implied warranty of16# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU17# General Public License for more details. 18#19# You should have received a copy of the GNU General Public License20# along with this program; if not, write to the Free Software21# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 22#23 24""" An AS for processing VirtualBox ELF64 coredumps """25# References:26# VirtualBox core format: http://www.virtualbox.org/manual/ch12.html#guestcoreformat27# ELF64 format: http://downloads.openwatcom.org/ftp/devel/docs/elf-64-gen.pdf28 29import struct30import volatility.plugins.addrspaces.standard as standard31 32#pylint: disable-msg=C011133 34class VirtualBoxCoreDumpElf64(standard.FileAddressSpace):35 """ This AS supports VirtualBox ELF64 coredump format """36 order = 3037 def __init__(self, base, config, **kwargs):38 ## We must have an AS below us39 self.as_assert(base, "No base Address Space")40 # Testing for ELF64, little-endian:41 self.as_assert((base.read(0, 6) == '\x7fELF\x02\x01'), "ELF64 Header signature invalid")42 self.as_assert((base.read(0x10, 2) == '\x04\x00'), "ELF64 type is not a Core file")43 (phoff,) = struct.unpack('<Q', base.read(0x20, 8))44 (phentsize, phnum) = struct.unpack('<HH', base.read(0x36, 4))45 found_note_vbcore = False46 found_load_ram = False47 for phptr in range(phoff, phoff + (phentsize * phnum), phentsize):48 (stype, flags, offset, vaddr, paddr, filesz, memsz, align) = struct.unpack('<IIQQQQQQ', base.read(phptr, phentsize))49 # NOTE VBCORE segment?50 if ((not found_note_vbcore) and (stype == 4)):51 (namesz, descsz, ntype) = struct.unpack('<III', base.read(offset, 12))52 if (base.read(offset+12, namesz) == 'VBCORE'):53 found_note_vbcore = True54 self.as_assert((descsz == 24), 'Abnormal VBCORE size')55 # parsing DBGFCOREDESCRIPTOR:56 (magic, fmtvers, selfsize, vbvers, vbrev, ncpus) = struct.unpack('<IIIIII', base.read(offset+12+((((namesz-1)>>3)+1)<<3), 24))57 self.as_assert((magic == 0xc01ac0de), 'Could not find VBox core magic signature')58 self.as_assert((fmtvers == 0x00010000), 'Unknown VBox core format version')59 # For info: VirtualBox version and revision are available in vbvers & vbrev60 continue61 # LOAD RAM segment?62 if ((not found_load_ram) and (stype == 1)):63 # LOAD segments contain also other stuff such as video memory64 # but we're only interested into main RAM, starting at physical address 065 if paddr == 0x0000000000000000:66 found_load_ram = True67 self.moffset = offset68 self.msize = filesz69 self.as_assert(found_note_vbcore, 'ELF error: did not find any NOTE segment with VBCORE')70 self.as_assert(found_load_ram, 'ELF error: did not find any LOAD segment with main RAM')71 standard.FileAddressSpace.__init__(self, base, config, layered = True, **kwargs)72 self.fsize = min(self.msize, self.fsize - self.moffset)73 74 def read(self, addr, length):75 return self.base.read(addr + self.moffset, length)76 77 def zread(self, addr, length):78 return self.base.zread(addr + self.moffset, length)79 80 def read_long(self, addr):81 return self.base.read_long(addr + self.moffset)82 83 def write(self, addr, data):84 return self.base.write(addr + self.moffset, data)85 86 def is_valid_address(self, addr):87 return self.base.is_valid_address(addr + self.moffset)88