Setting Up a Windows Virtual Machine for SANS FOR526 As part of the Windows Memory Forensics course, SANS FOR526, you will need to create a Windows virtual machine to use in class. We recommend using VMware to do this, and the following instructions are predicated on using VMware Workstation. The course is designed to use a 32- bit version of Windows 7. 1. Create the Virtual Machine The exact instructions vary by host platform: Microsoft Windows: A. From the File menu, choose New. B. Select Typical to create a typical new virtual machine. C. Insert your Windows installation disc and choose Use a physical disc. D. Choose the Easy Install method and follow the prompts. You can use anything you d like for the virtual machine name and username. But be sure to write down your password! Mac OS X: A. From the File menu, Choose New. B. Insert your Windows installation disc and follow the prompts. C. It is safe to accept the defaults. Your virtual machine will need to access the network. You can use anything you d like for the virtual machine name and username. But be sure to write down your password! 2. Patch the virtual machine to the current service pack (SP1 as of press time). A. Boot the virtual machine.
B. In the VM, from the Start Menu, choose All Programs, then Windows Update. C. Select Turn on Automatic Updates. D. Choose Install Updates. E. Follow the prompts necessary to install the Important updates (these vary depending on the current patch level of Windows.) You will have to restart at least once during this process. You will also have to manually shut down the VM at least once too. Shutting down the VM will install some updates. Even after shutting down and restarting the virtual machine, you must run Windows Update again and install the remaining updates. F. You do not need to install any of the Optional updates. 3. Download and install the Windows debugging tools The debugging tools are part of the Windows Software Development Kit (SDK). Download the installer of the latest version of the SDK. As of press time, this was the Windows 8 Consumer preview, http://msdn.microsoft.com/en- us/windows/hardware/hh852363. A. Download the sdksetup.exe program from the above URL and run it. B. Accept the default installation location. C. Decline the Customer Experience Improvement Program. D. Read and accept the user agreement. E. Deselect all of the tools to install EXCEPT the Windows debugging tools. The result should look like:
Then install the debugging tools by clicking the Install button. 4. Download and Install livekd and Process Monitor. We re going to use these utilities to examine our virtual machine. You will need to download these tools from: Livekd: http://technet.microsoft.com/en- us/sysinternals/bb897415 Process Monitor: http://technet.microsoft.com/en- us/sysinternals/bb896645 For each of them, double- click the archive, and then click the Extract all files button. Save the extracted files to a new directory, C:\bin. 5. Create and update environment variables
To make our programs run correctly, we are going to create and update some environment variables. We need to configure a variable to download any necessary debugging symbols from Microsoft. To do this: A. Open the Control Panel. B. Choose System and Security. C. From the right- hand panel, choose System. D. Verify that you have installed a 32- bit operating system. This value is noted in the System type field on the right hand side of the window. E. From the left- hand panel, choose Advanced system settings : F. At the bottom of the Window, choose Environment variables. You should see this panel:
G. In the bottom part of the window, under System variables, create a new variable. H. Assign the Variable name to _NT_SYMBOL_PATH and the Variable value to srv*c:\symbols*http://msdl.microsoft.com/download/symbols. Click the OK button to save this variable. I. Also in the System variables window, find the variable Path. Click Edit and append a semi- colon and the following string to the existing value: C:\Program Files\Windows Kits\8.0\Debuggers\x86;C:\bin When you are finished, the overall variable should look like:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SY STEMROOT%\System32\WindowsPowerShell\v1.0\; C:\Program Files\Windows Kits\8.0\Debuggers\x86;C:\bin If you are not sure if you have done it correctly, you can copy and paste the value to another program, like Notepad, and edit it there. 6. Test Out the Debugger We should be finished with the debugging tools. Let s take them out for a spin! A. From the Start Menu, choose All Programs- >Accessories. B. Right- click on Command Prompt and choose Run as Administrator. Accept the option in the dialog box which appears. C. Type livekd - w (without the quotes), hit enter, and accept the EULA. D. As the WinDBG window opens, you may be asked if you want save information for a workspace. Click Yes E. Wait for a minute as WinDBG downloads the symbols you ll need. You may get an error about how symbols for livekd.sys could not be found. That s normal. F. In the end, you should see something like this:
Download and Install Moonsols DumpIt tool We re going to use DumpIt to capture memory images on our VM. To install it: A. Go to http://www.moonsols.com/ressources/ and find the button for DumpIt. Click it to download. B. Double- click on the downloaded zip file to open it. C. Click the Extract all files button. Save the extracted files to the C:\bin directory.