Volatility 3
Definition
Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11 and Linux kernels, plugin ecosystem includes pslist, pstree, psxview, malfind, hollowfind, netscan, dlllist.
- Category
- Open-source memory forensics framework
- Language
- Python 3
- Symbol approach
- Symbol-based (e.g. PDB symbols on Windows), not profile-based
- OS support
- Modern Windows 10/11 and Linux kernels
- Example plugins
- pslist, pstree, malfind, netscan, dlllist
Common questions
What practical problem does the symbol-based approach solve compared with Volatility 2's profiles?+
Volatility 2 required a matching pre-built profile for each specific OS build, which lagged behind new Windows and Linux releases. Volatility 3 fetches or uses public symbol information directly, so it can analyse a wider range of current OS versions without waiting for a profile to be published.
What does a plugin like malfind actually look for in a memory image?+
malfind scans process memory regions for characteristics typical of injected or unbacked executable code, such as memory permissions and content patterns inconsistent with a normal loaded module, flagging candidates for deeper manual review rather than definitively confirming malware.
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...