I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB).I want to extract as many features as possible from this dump. Mainly I want to extract all stacks of all threads running on the machine and exist in the memory. Alternatively, I want to extract call sequences of all threads.Are there any tools / tutorials / books etc. which can help me perform this task?I am familiar with both Volatility and Rekall, are there any specific plugins that can help me achieve my goals there?
Extracting threads' stack from Windows memory dump
digital forensics;callstack;thread;stack;process
I am Not Sure what you are looking for let me try    i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it    i loaded it using windbg as below    windbg -z memory.dmp now i thought i will count how many threads are running so i did some thing like this kd> r $t0 = 0; !for_each_thread r $t0= @$t0+1 ; ? @$t0Evaluate expression: 306 = 00000132now let me see the call stacks for all threads so i do kd> !for_each_thread  .thread @#Thread ; k2it spits out Implicit thread is now 812915b8 # ChildEBP RetAddr  00 fc8d37b4 804dc0f7 nt!KiSwapContext+0x2e01 fc8d37c0 804e3b7d nt!KiSwapThread+0x46Implicit thread is now 8128eda8 # ChildEBP RetAddr  00 fc8e3d34 804dc0f7 nt!KiSwapContext+0x2e01 fc8e3d40 804e407e nt!KiSwapThread+0x46Implicit thread is now 8128eb30 # ChildEBP RetAddr  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxok instead of k2 i do k i get a full stack trace Implicit thread is now 810efda8  *** Stack trace for last set context - .thread/.cxr resets it # ChildEBP RetAddr  00 f8ad3c38 804dc0f7 nt!KiSwapContext+0x2e01 f8ad3c44 804dc143 nt!KiSwapThread+0x4602 f8ad3c6c bf802f52 nt!KeWaitForSingleObject+0x1c203 f8ad3ca8 bf801b2a win32k!xxxSleepThread+0x19204 f8ad3cec bf819e6c win32k!xxxRealInternalGetMessage+0x41805 f8ad3d4c 804de7ec win32k!NtUserGetMessage+0x2706 f8ad3d4c 7c90e4f4 nt!KiFastCallEntry+0xf807 0007fe24 7e4191be ntdll!KiFastSystemCallRet08 0007fe44 0100a740 USER32!NtUserGetMessage+0xc09 0007fe80 0100c216 wmiprvse!WindowsDispatch+0x310a 0007ff14 0100c314 wmiprvse!Process+0x2250b 0007ff1c 010247aa wmiprvse!WinMain+0x4e0c 0007ffc0 7c817067 wmiprvse!WinMainCRTStartup+0x1740d 0007fff0 00000000 kernel32!BaseProcessStart+0x23Implicit thread is now 8113b960  *** Stack trace for last set context - .thread/.cxr resets itXXXXXXXXXXXXXXXXhope your query is answered if not please explain what is it you mean by call sequences addressing the comment by Igor Skochinsky if the format of the file is raw as in lets say captured with matthieu suiches now defunct win32dd.exe one can use volatility's plugin raw2dmp and use the resulting windbg compatible dmpfile in windbg as abovevol25 -f foo.dmp --profile=Win7SP1x86 imageinfoVolatility Foundation Volatility Framework 2.5INFO    : volatility.debug    : Determining profile based on KDBG search...          Suggested Profile(s) : Win7SP0x86, Win7SP1x86                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)                     AS Layer2 : FileAddressSpace (E:\vola\foo.dmp)                      PAE type : PAE                           DTB : 0x185000L                          KDBG : 0x82d32c28L          Number of Processors : 1     Image Type (Service Pack) : 1                KPCR for CPU 0 : 0x82d33c00L             KUSER_SHARED_DATA : 0xffdf0000L           Image date and time : 2016-06-02 18:08:14 UTC+0000vol25 -f foo.dmp  --profile=Win7SP1x86 raw2dmp --output-image=foowind.dmpVolatility Foundation Volatility Framework 2.5Writing data (5.00 MB chunks): |.....dumpchk.exe foowind.dmp Loading dump file foowind.dmpMicrosoft (R) Windows Debugger Version 10.0.10586.567 X86Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [xxx\foowind.dmp]Kernel Complete Dump File: Full address space is availableComment: 'File was converted with Volatility'xxxxxxxxxxxxxxxxxxxxxxx*** ERROR: Module load completed but symbols could not be loaded for win32dd.exeCannot find frame 0x6c, previous scope unchanged*** ERROR: Module load completed but symbols could not be loaded for win32dd.sysProbably caused by : win32dd.exe ( win32dd!Unknown )