residentmem — Volatility 3 Plugin

residentmem is a Volatility 3 plugin that, for a Windows memory dump, reports how many memory pages of each user-space module (executable or DLL) and each kernel driver are resident in memory, together with the total number of pages each one occupies.

This is the Volatility 3 port. The original Volatility 2.6 version is preserved on the volatility2-latest branch.

About

The ratio Resident / Total is the page residency ratio of a module: the fraction of its image that is actually present in the captured memory — and therefore recoverable — as opposed to the pages that have been paged out, never demand-paged in, or lost to page smearing.

This plugin was developed for, and implements the measurements described in, the following peer-reviewed article:

Miguel Martín-Pérez and Ricardo J. Rodríguez. "Quantifying Paging on Recoverable Data from Windows User-Space Modules." In Digital Forensics and Cyber Crime — 12th EAI International Conference (ICDF2C 2021), Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering (LNICST), vol. 441, pp. 1–19. Springer, Cham, 2022. DOI: 10.1007/978-3-031-06365-7_1

If you use this plugin in your research, please cite the article (see Citation).

How it works

For every loaded module (per process) and every system driver, residentmem:

1. Walks the module image one page at a time, from its base address (DllBase) up to SizeOfImage.
2. Counts a page as resident when it is mapped/valid in the corresponding address space (the per-process layer for user-space modules; the session/kernel layer for drivers).
3. Reports the resident count, the total number of pages (ceil(SizeOfImage / page_size)), the module's PE file version, and its full path.
4. Optionally dumps, per module/driver, a CSV with the virtual-to-physical address mapping of every resident page.

Installation

Volatility 3 must be installed. Then either:

• Pass the plugin directory at runtime with -p / --plugin-dirs, or
• Copy residentmem.py under volatility3/framework/plugins/windows/.

Usage

usage: vol.py residentmem.ResidentMem [-h] [--pid [PID ...]]
[--page-size PAGE-SIZE] [--dump]
Counts how many memory pages are resident in a Windows memory image per module
(exe or dll) and per system driver.
optional arguments:
-h, --help show this help message and exit
--pid [PID ...] Process IDs to include (all other processes are excluded)
(e.g. --pid 252 | --pid 252 452 2852)
--page-size PAGE-SIZE
Page size in bytes used to walk the modules (default: 4096)
--dump Dump a CSV (virtual,physical address) file per module/driver

Output columns

Column	Description
Pid	Owning process PID (N/A for drivers)
Process	Owning process image name (-- for drivers)
Module Name	Base name of the module/driver
File Version	PE file version (- when not available)
Module Base	Virtual base address of the module
Resident	Number of pages resident in the dump
Total	Total number of pages of the module image
Path	Full path of the module/driver
Dump file	CSV file written when --dump is set (N/A otherwise)

Usage example

$ python3 vol.py -p /path/to/plugin -o dump-dir -f /path/to/memory.dump residentmem --pid 260 --dump
Volatility 3 Framework 2.28.1
Pid Process Module Name File Version Module Base Resident Total Path Dump file
260 smss.exe smss.exe 6.1.7601.24545 0x47760000 32 32 \SystemRoot\System32\smss.exe pid.260.smss.exe.smss.exe.csv
260 smss.exe ntdll.dll - 0x76f40000 177 415 C:\Windows\SYSTEM32\ntdll.dll pid.260.smss.exe.ntdll.dll.csv
N/A -- ntoskrnl.exe 6.1.7601.24545 0xf80001867000 1501 1501 \SystemRoot\system32\ntoskrnl.exe driver.ntoskrnl.exe.csv
N/A -- CLFS.SYS - 0xf88000cb0000 92 96 \SystemRoot\system32\CLFS.SYS driver.CLFS.SYS.csv
...

For drivers, the Pid column is N/A and the Process column is --.

Each CSV produced with --dump contains the resident pages of one module:

VADDR,PHYADDR
0x47760000,0x1b2bdf000
0x47761000,0x1b2b16000
...

Differences from the Volatility 2 version

• --pid takes a space-separated list (Volatility 3 convention) instead of the comma-separated -p option.
• -D DUMP_DIR is replaced by --dump; CSV files are written to Volatility 3's global output directory (set with -o DIR), named pid.<pid>.<process>.<module>.csv for modules and driver.<module>.csv for drivers.
• The --logfile option has been removed: Volatility 3 does not truncate the full module/path names, and complete, machine-readable output is available through the built-in renderers (-r csv, -r json, ...).

Citation

@inproceedings{MartinPerez2022Quantifying,
author = {Mart{\'i}n-P{\'e}rez, Miguel and Rodr{\'i}guez, Ricardo J.},
title = {Quantifying Paging on Recoverable Data from {Windows} User-Space Modules},
booktitle = {Digital Forensics and Cyber Crime (ICDF2C 2021)},
series = {Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering (LNICST)},
volume = {441},
pages = {1--19},
year = {2022},
publisher = {Springer, Cham},
doi = {10.1007/978-3-031-06365-7_1}
}

Authors

Developed in 2020 at the RME-DisCo research group, University of Zaragoza (Spain):

• Miguel Martín-Pérez (original author)
• Ricardo J. Rodríguez

License

Licensed under the GNU GPLv3 license.