Lesson 2.52: Finding hidden processes in a memory image
A rootkit can make the live system lie, but it can't edit the copy of memory you already took. Volatility walks the kernel's own task list inside the image, so processes hidden from /proc show up. Comparing what memory says with what the live host says is one of the strongest tests for a rootkit. In the lab you list processes from db02's image, diff them against the live /proc, and read the hidden ones' command lines, environment and network sockets.
18 min
You will learn to
- List processes from memory with linux.pslist
- Diff memory against the live /proc
- Read arguments and environment with linux.psaux and linux.envars
- Read sockets from memory with linux.sockstat
- Explain why memory beats live tools against rootkits
Key terms
- linux.pslist
- Lists processes by walking the kernel's task list in the image.
- linux.psaux
- Process command lines from memory.
- linux.envars
- Process environment variables from memory.
- linux.sockstat
- Network sockets per process from memory.
- Cross-view analysis
- Comparing two sources of the same fact (memory vs /proc) to expose hiding.
- /dev/shm
- A RAM-backed file system; files there disappear at reboot.
← Auditing every program a person runs · All lessons · Malicious attachments →