- window_list - give a text listing of the window hierarchy, with each window's on-screen coordinates, current style, and its class (Button, Window, etc.). Here's some example output to whet your appetite.
- screenshot - save a wireframe "screenshot" of the on-screen windows in a memory image. See later in this post for some examples. Requires PIL.
- wndmon - continuously monitor a memory image and provide an updating view of the on-screen windows. Works best in a live environment, e.g. with XenAccess and PyXa. Requires PyGame. (This is what I used for the video demo).
- Get distorm3 from its Google Code site.
- Go into build/linux and type "make".
- Copy the resulting libdistorm3.so into the Python directory.
- Rename the Python directory to "distorm" and move it somewhere in your Python path (I use Debian, and found that /usr/local/lib/python2.6/dist-packages/ worked well).
Have fun with the code. If you go exploring in the source, you may find some interesting things -- there's more functionality there than is exposed through the plugins, including some functions and data structures that can extract HTML content from IE in memory... ;)
Anyway, to wrap things up, here's an example of the output from the screenshot plugin, running on the two NIST memory images:
From the 6/25 image:
From the 7/4 image:
And that, my friends, is the power of memory analysis.