{"id":33193647,"url":"https://github.com/borjamerino/doublepulsar-volatility","last_synced_at":"2026-01-17T12:00:49.267Z","repository":{"id":75460165,"uuid":"100258198","full_name":"BorjaMerino/DoublePulsar-Volatility","owner":"BorjaMerino","description":"Volatility plugin to help identify DoublePulsar implant by listing the array of pointers SrvTransaction2DispatchTable from the srv.sys driver.","archived":false,"fork":false,"pushed_at":"2017-08-14T13:50:47.000Z","size":8,"stargazers_count":16,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-05-18T12:34:13.837Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BorjaMerino.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-08-14T11:00:53.000Z","updated_at":"2019-11-06T10:41:08.000Z","dependencies_parsed_at":"2023-06-06T13:15:09.647Z","dependency_job_id":null,"html_url":"https://github.com/BorjaMerino/DoublePulsar-Volatility","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/BorjaMerino/DoublePulsar-Volatility","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BorjaMerino%2FDoublePulsar-Volatility","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BorjaMerino%2FDoublePulsar-Volatility/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BorjaMerino%2FDoublePulsar-Volatility/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BorjaMerino%2FDoublePulsar-Volatility/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BorjaMerino","download_url":"https://codeload.github.com/BorjaMerino/DoublePulsar-Volatility/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BorjaMerino%2FDoublePulsar-Volatility/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28508464,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T11:50:55.898Z","status":"ssl_error","status_checked_at":"2026-01-17T11:50:55.569Z","response_time":85,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-11-16T07:00:31.294Z","updated_at":"2026-01-17T12:00:49.181Z","avatar_url":"https://github.com/BorjaMerino.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility"],"sub_categories":[],"readme":"# DoublePulsar-Volatility Plugin\n\u003cp align=\"justify\"\u003eVolatility plugin to help identify DoublePulsar implant. The plugin is not based on Yara rules. It just dumps the array of functions pointers SrvTransaction2DispatchTable from the srv.sys driver and checks that all of them points to the binary address space (take a look at Zerosum0x0 analysis: https://zerosum0x0.blogspot.com.es/2017/04/doublepulsar-initial-smb-backdoor-ring.html). Note that although the plugin dumps the whole table it would really only be necessary to verify that the SrvTransactionNotImplemented symbol points to the correct place.\n\n\u003cp align=\"justify\"\u003eThe plugin resolves SrvTransaction2DispatchTable by getting the .pdb path from the debug directory section and downloads it from http://msdl.microsoft.com/download/symbols (or the server you provide with the SYMBOLS option). Once it gets the symbol offset it just dump the array of pointers. If SrvTransactionNotImplemented (entry14) points to an \"unknown\" location possibly your are dealing with DoublePulsar. It that case volshell and dis() will clear up any doubts.\n\nTo run the plugin be sure to have the following dependencies:\n\n    construct:  pip install construct==2.5.5-reupload\n    pdbparse:   pip install pdbparse\n    pefile:\t    pip install pefile\n    requests:   pip install requests\n    cabextract: apt-get install cabextract\n\nTested on: Windows 7 SP1 32 bits / Windows 7 SP1 64 bits\nEj:\n\n```\nbmerino@kali:~$ volatility --plugins=\"/usr/share/volatility/contrib/plugins\"  -f memory.0c672b16.img --profile=Win7SP1x64 doublepulsar -D /tmp\nVolatility Foundation Volatility Framework 2.6\n\nPtr                Module       Section     \n------------------ ------------ ------------\n0xfffff880038a9060 srv.sys      PAGE        \n0xfffff88003873d90 srv.sys      PAGE        \n0xfffff880038a6820 srv.sys      PAGE        \n0xfffff880038758c0 srv.sys      PAGE        \n0xfffff8800389b600 srv.sys      PAGE        \n0xfffff880038738e0 srv.sys      PAGE        \n0xfffff880038a9590 srv.sys      PAGE        \n0xfffff8800386cbf0 srv.sys      PAGE        \n0xfffff88003871310 srv.sys      PAGE        \n0xfffff8800388fd20 srv.sys      PAGE        \n0xfffff880038a93c0 srv.sys      PAGE        \n0xfffff8800388fd20 srv.sys      PAGE        \n0xfffff8800388fd20 srv.sys      PAGE        \n0xfffff8800389bdd0 srv.sys      PAGE        \n0xfffffa800074c060 UNKNOWN                  \n0xfffff8800388fb20 srv.sys      PAGE        \n0xfffff88003895830 srv.sys      PAGE \n```\nMore info: http://www.shelliscoming.com/2017/08/doublepulsar-smb-implant-detection-from.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fborjamerino%2Fdoublepulsar-volatility","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fborjamerino%2Fdoublepulsar-volatility","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fborjamerino%2Fdoublepulsar-volatility/lists"}