Reported by phatbuck...@gmail.com, Jul 24, 2011

Enhancement submission; would love to see the capability to dump contents of the DNS resolver cache if possible. Something akin to "ipconfig /displaydns".

Would also be interesting to see representation of which DNS resolvers are configured on the system.

Perhaps also useful to view the IP address of the DHCP server (if any) that provided the lease to the host.

Thinking about hostname-based attribution of connection information provided by connections/connscan/netscan, DNS hijacking malware, rogue DHCP server detection, etc.

Jul 24, 2011
Project Member #1 mike.auty@gmail.com

(No comment was entered for this change.)

Labels: -Type-Defect Type-Enhancement
Jul 25, 2011
Project Member #2 michael.hale@gmail.com

Thanks for the suggestion, I share the desire for a plugin of this sort. Actually I came close to finding the info when writing the netscan plugin. It may take a little bit, but we'll let you know when its done!

Nov 13, 2011
#3 marko.th...@gmail.com

Hello,here is dnscache plugin, please report all the bugs :) the code looks like crap :( To use this, you need a new version of my heap plugin which is available in another issue.

Nov 14, 2011
Project Member #4 michael.hale@gmail.com

Just CC'ing some others so they know the plugin exists and can check it out. 

Cc: mike.auty@gmail.com scude...@gmail.com labaru...@gmail.com jamie.l...@gmail.com moo...@gmail.com
Nov 15, 2011
#5 marko.th...@gmail.com

Here is a fixed version of the dnscache plugin.

    dnscache.py
8.5 KB   View   Download
Jan 23, 2012
Project Member #6 mike.auty@gmail.com

So I just tried this recently, and ran into a problem with the plugin requiring volatility.plugins.heap, is that another private plugin?  If so, would you be willing to post that as well please?

Jan 23, 2012
#7 phatbuck...@gmail.com

Found posted at least here:

https://code.google.com/p/volatility/issues/attachmentText?id=149&aid=1490011000&name=heap.py&token=YQ42pDThBAxlcjnaQ9VjZ0tw2j0%3A1327342168317

Unsure if updates available anywhere since then.

Jan 23, 2012
Project Member #8 mike.auty@gmail.com

Ok, seems to work on my XP image, but fails on Windows 7 with:

Traceback (most recent call last):
  File "vol.py", line 135, in <module>
    main()
  File "vol.py", line 126, in main
    command.execute()
  File "/home/mike/workspace/volatility/volatility/commands.py", line 101, in execute
    func(outfd, data)
  File "/home/mike/workspace/volatility/volatility/plugins/dnscache.py", line 267, in render_text
    for record_name,record_type,ttl,datalen,section,data in data:
  File "/home/mike/workspace/volatility/volatility/plugins/dnscache.py", line 191, in calculate
    for procname, pid, heap, heap_segments, heap_freelists, heap_virtual_blocks in heapscan.HeapScan(self._config).calculate(pid):
  File "/home/mike/workspace/volatility/volatility/plugins/heap.py", line 84, in calculate
    for offset in heap.Segments:
  File "/home/mike/workspace/volatility/volatility/obj.py", line 777, in __getattr__
    return self.m(attr)
  File "/home/mike/workspace/volatility/volatility/obj.py", line 762, in m
    raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr))
AttributeError: Struct _HEAP has no member Segments

Jan 30, 2012
#9 marko.th...@gmail.com

Thanks for testing it. I try to fix it soon for Windows 7 :)

Jan 31, 2013
Project Member #10 michael.hale@gmail.com

Hey guys, I'm going to drop this down to low. Marko, if you happen to upgrade to support Windows 7 (and other hardware archs like x64) or need help doing so, we can bump back up and look into getting it into a future release. 

Labels: -Priority-Medium Priority-Low
Jun 12, 2013
#12 kha...@gmail.com

Updated dnscache.py to work in 2.3 beta.
Attached.

    dnscache.py
8.9 KB   View   Download
Aug 13, 2013
#13 bry...@gmail.com

I have updated the code to remove the dependency on heapscan - it now operates similar to a scanner going though the process memory (and could potentially be migrated to one.)

Unfortunately it still only produces results under a specific profile - 32 bit Windows XP. I suspect the format of the data structure in memory changed between XP and Vista.

Updated version attached, fully 2.3BetaSVN compatible. 

Note: I have changed the name of the command to "dnscachedump" to avoid conflicts against the older heapscan based version.

    dnscachedump.py
9.9 KB   View   Download