## Volatility Framework Deep Dive

**Volatility** is the industry-standard (Command Line) tool for analyzing memory dumps. It supports Windows, Linux, and Mac.

### The Profile (Volatility 2 vs 3)
*   **Volatility 2**: Required you to specify the "Profile" manually (e.g., `Win10x64_1909`). If you got it wrong, it output garbage.
*   **Volatility 3**: Modern version. It detects the OS automatically using Symbol Tables.

### Essential Commands (Plugins)
Assuming you have a distinct memory image `mem.dmp`:

1.  **pslist / psscan**: List processes.
    *   `pslist`: Walks the "Active Process Head" (What Windows *admits* is running).
    *   `psscan`: Scans raw memory bytes for EPROCESS structures. (Finds "Hidden" processes that unlinked themselves from the list).
    *   *Comparison*: If a PID shows up in `psscan` but NOT `pslist`, it is a **Rootkit**.
2.  **netscan**: List network connections.
    *   Shows Protocol, Local IP, Remote IP, State (ESTABLISHED), and PID.
    *   "Why is `notepad.exe` connected to Russia on Port 4444?"
3.  **malfind**: Detects code injection.
    *   It looks for memory pages that are:
        *   Executable (RWX permissions).
        *   Start with `MZ` header (Executable file) OR generic Shellcode patterns.
    *   Output: Hex dump of the injection.
4.  **dlllist**: List loaded DLLs for a process.
    *   "Why does `svchost.exe` have `cryptominer.dll` loaded?"
5.  **cmdline**: Shows the command line arguments.
    *   `powershell.exe -w hidden -enc JABz...` (Base64 encoded evil script).

### Workflow
1.  Identify rogue networking (`netscan`). -> Found PID 1234.
2.  Investigate process (`pslist`). -> PID 1234 is `svchost.exe`.
3.  Check parent (`pstree`). -> Parent is `explorer.exe`. (BAD. `svchost` should come from `services.exe`).
4.  Check injection (`malfind -p 1234`). -> Found RWX memory segment.
5.  Dump the malware (`procdump -p 1234`). -> Save to disk for Reverse Engineering.