volafox: Mac OS X Memory Analysis Toolkit
project: https://github.com/n0fate/volafox
support: 10.6-11(Snow Leopard ~ El Capitan); 32/64-bit kernel
  input: raw memory image (*.mem or exported raw memory image using rekal developed by google
  -> If you get a AFF4 format, you can export linear memory image as following cmd : rekal aff4export -D . [AFF4 MEMORY IMAGE]

  usage: python vol.py -i IMAGE [-o COMMAND [-vp PID][-x PID][-x KEXT_ID][-x TASKID][-x SYMFILENAME]]

Options:
-o CMD            : Print kernel information for CMD (below)
-p PID            : List open files for PID (where CMD is "lsof" and dumpfile)
-v                : Print all files, including unsupported types (where CMD is "lsof")
-x PID/KID/TASKID/SYMBOLNAME/Virtual ADDRESS :
   Dump process/task/kernel extension address space for PID/KID/Task ID (where CMD is "ps"/"kextstat"/"tasks"/"machdump"/"dumpsym"/"dumpfile")

COMMANDS:
system_profiler : Kernel version, CPU, and memory spec, Boot/Sleep/Wakeup time
mount           : Mounted filesystems
kextstat        : KEXT (Kernel Extensions) listing
kextscan        : Scanning KEXT (Kernel Extensions) (64bit OS only)
ps              : Process listing
tasks           : Task listing (Finding process hiding)
machdump        : Dump macho binary and relocation for analysis
systab          : Syscall table (Hooking detection)
                  => Call Number 427 is bugged not hooked.
mtt             : Mach trap table (Hooking detection)
netstat         : Network socket listing (Hash table)
lsof            : Open files listing by process (research, [email protected])
dumpfile        : Dump a file on Memory (Required -p and -x option)
pestate         : Show Boot information
efiinfo         : EFI System Table, EFI Runtime Services
keychaindump    : Dump master key candidates for decrypting keychain(Lion ~ El Capitan)
dmesg           : Debug message at boot time
uname           : Print a short for unix name(uname)
hostname        : Print a hostname
notifiers       : Detects I/O Kit function hooking
trustedbsd      : Show TrustedBSD MAC Framework
bash_history    : Show history in bash process
sysctl          : show the result like sysctl command
dumpsym         : Dump kernel symbol address considered of KASLR to file (for RCE)

Kernel Rootkit Detection: (testing code by n0fate) - Required Library : distorm3
kdebug_hook     : Examination of the KDebug function code for mal-code detection
kauth_hook      : Examination of the KAUTH for mal-code hiding detection from Anti-virus
bsm_hook        : Examination of auto_commit function on the OpenBSM
fbt_syscall     : Examination of syscall table for hooking by DTrace FBT Provider