Wednesday, February 05, 2014

Volatility on Mac OS X 10.9.1

The Volatility Framework

Quoting from the volatility home page: "The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples."

Or put more simply, you collect a memory dump from a system and Volatility helps you investigate what was running on the machine at the time of the memory dump.

You can get a list of processes or a list of open files that is computed on a clean system so it's not subject to a potentially-rootkit-replaced /bin/ps or /usr/sbin/lsof.

There are many other useful built in commands and the framework works on Mac, Linux and Windows.

Very basic usage

I used OSXPmem to get a memory dump:
$ sudo ./osxpmem -f raw /tmp/memory.dump

Once you get the dump (which is fairly slow as you're dumping your entire physical memory to disk) you can get a list of running processes:
$ sudo python -i /tmp/memory.dump -o ps
[+] Process List
0x150FBCC0      0     0        0    0      kernel_task                    (0,0)         (0,0) Tue Dec 17 11:36:22 2013 
0x15593A80      1     0      128    0          launchd      _securityagent(0,0)         (0,0) Tue Dec 17 11:36:22 2013 
0x155947E0     11     1      255    0   UserEventAgent                root(0,0)         (0,0) Tue Dec 17 11:37:20 2013 

or look up the kernel syscall table:
$  sudo python -i /tmp/memory.dump -o systab
[+] Syscall List
0           0                          _nosys 0xFFFFFF8014DEF270         0x00000000      0x00000000        1         0 True
1           1                           _exit 0xFFFFFF8014DCBE50 0xFFFFFF8014BBBD30      0x00000000        0         4 True
2           0                           _fork 0xFFFFFF8014DD07E0         0x00000000      0x00000000        1         0 True
3           3                           _read 0xFFFFFF8014DEF2D0 0xFFFFFF8014BBBD60      0x00000000        6        12 True
4           3                          _write 0xFFFFFF8014DEF980 0xFFFFFF8014BBBD60      0x00000000        6        12 True

Friday, January 17, 2014

Mac OS X Mavericks MapKit notes

A few days ago when I opened Maverick's and I had the curiosity to navigate to a mountainous region I was blown away. The satellite imagery provided by Apple's is much better than Google Earth's, at least in the areas I'm interested in.

See below a same-area-comparison of vs Google Earth; in the left hand side the cable car pillar is clearly seen whereas in the right hand side it's a total blur:

In you can distinguish relatively small features, valleys and ridges in the 3D view, making a possible tool to use when planning or remembering a hiking trip. If only there was a way to annotate the map with more than pins.

These here are my notes on trying to annotate Apple's imagery with external data.

Using with an external data source

The first thing I've tried was using itself.
I haven't found any way to add external content (other than pins).

Which is sad, because the MapKit framework powering part of the app (there's also a private framework behind it, which as far as I can tell provides the data behind satellite imagery and vector data) makes it very easy to display tiles from an external provider.

I can only hope a future version will offer some way of loading external content (e.g. Google Earth's NetworkLink or maybe exposing MapKit's capability to load external map tiles - see below).

Developing an application using MapKit

As was out of the question, I then summoned my Objective-C almost forgotten skills and tried the MapKit framework, freshly arrived in Mavericks from the iOS world.

While using XCode does not require an active (as in currently payed for) Apple developer account, using MapKit does (when a developer account is not active, MapKit will print a warning on the console and refuse to load any Apple provided data).

Once you have an active developer account, XCode requests a MapKit for you.
After the entitlement is approved (in my case it took a half an hour or so), MapKit starts displaying data. is 3D, MapKit is 2D

This is my biggest gripe with MapKit so far. has 3D data (it probably uses something similar to the SRTM dataset to build an elevation profile and warps imagery over the slopes computed based on the elevation grid).

MapKit does not have 3D data and all it offers in this regard is a pseudo-3D view based on tilting the camera. Even this pseudo-3D view is restricted to the standard map view (in satellite and hybrid modes tilting the camera does not work).

Lack of 3D makes MapKit pretty useless for me - the great appeal of MapKit was the good quality of satellite imagery in Romania's mountains but without 3D the imagery gets really hard to decipher as lack of altitude information makes valleys look like ridges and vice-versa.

Integrating OpenStreetMap tiles within a MapKit app

Apple's MapKit makes it very easy to load OpenStreetMap tiles in the MapKit views (pictured below are some tiles from our hiking web application overlaid on top of MapKit's hybrid view:

In 10 or so lines of code you can have tiles in your MapKit based map.

You add an overlay:
NSString *template = @"http://some.server/tiles/{z}/{x}/{y}.png";
MKTileOverlay * overlay = [[MKTileOverlay alloc] initWithURLTemplate:template];
[map addOverlay:overlay];

and in the map's delegate you create a renderer for it:
- (MKOverlayRenderer *)mapView:(MKMapView *)mapView 
    rendererForOverlay:(id < MKOverlay >)overlay
    if([overlay isKindOfClass:[MKTileOverlay class]])
        MKTileOverlayRenderer * r = [[MKTileOverlayRenderer alloc] initWithOverlay:overlay];
        return r;
    return nil;

What about vectors?

Yes, you can add vectors (points, lines, polygons, custom shapes) as overlays on top of the MapKit view.

The problem is built in overlays are painfully basic.
Meaning I couldn't find a way to display a label (only a pin that displays something when clicked) or that the built in MKPolyline renderer does not display the MKPolyline's title (you have to write your own overlay renderer to do that).

Below is a screenshot of my MapKit test app, showing a couple of valleys in red (using the built in MKPolyline) and a few labels (implemented using a custom data overlay and renderer):


MapKit is a big help when trying to build a map application but don't kid yourself - building a proper mapping app takes a LOT of work.

I look forward to buying a MapKit based app that matches Google Earth's integration capabilities.

Thursday, January 16, 2014

Actualizări în Iezer

Mai jos poze cu indicatoarele de la cabana Cuca.

Timpii afișați pentru vârfurile Păpușa și Cascue sunt probabil greșiți (noi am făcut trei ore de la Cuca până pe Păpușa mergând în ritm normal).

Cu ocazia turei am actualizat zona pe OpenStreetMap și am adăugat vârfurile pentru care am avut date (Păpușa din datele GPS și restul (Oticu, Roșu, Piscanu, Cățunu, Văcarea, Bătrâna, Găinațul Mare, Țefeleica) pe baza profilelor de altitudine SRTM).

Interposing in Mavericks

Somewhere along Lion or Mountain Lion Apple switched from gcc to clang as the default compiler.
One of the things that clang does differently is it does not create a Mach DATA section for interposing.

Below is a screenshot of MachOView on dynamic libraries compiled by gcc and clang respectively (I've used the Mavericks gcc 4.9 binary downloaded from High Performance Computing).

I've no idea if clang can be instructed to create the DATA interpose section but if you need to use it in recent Mac OS X versions compiling with gcc still works.

Wednesday, January 01, 2014

Marcaje Baiului

Marcaje din Baiului, pe Bușteni - Culmea Zamora - Culmea Orjogoaia - Trăisteni și Șaua Băiuțului - Telgondola Sorica:


Bușteni - Culmea Zamora

Azuga - Culmea Sorica

Wednesday, November 06, 2013

Traseu nou în

La ultima tură am cartat parțial traseul ce merge de la Susai spre Lacul Roșu:

Cabana Susai - Cabana Lacul Roșu

Track-ul GPS pe OpenStreetMap.

În zonă mai există un traseu care pleacă de la Susai și merge spre Sud-Est pe marcaj triunghi albastru dar n-am apucat să-l parcurgem. Deși pe copaci e destul de șters cât să nu pară marcaj nou, triunghiul albastru nu apare pe harta tipărită (harta lui Dănuț Călin) din holul cabanei Susai.

Sunday, November 03, 2013

Vederi din Zamora

Caraiman și Coștila

Clăile, creasta cu zâmbri


Sunday, October 27, 2013

Tură pe Jepii Mici

Cascada Caraiman

Vederi de pe Jepii Mici

Portița Caraimanului și Brâul Portiței

Construcția de pe vârf, transformată în depozit de pet-uri

Pe poteca asfaltată


Cu ocazia plimbării am corectat coordonatele vârfului Jepii Mici în openstreetmap - varianta veche o luasem de pe profilele de altitudine SRTM și era greșită cu câteva zeci de metri.