はじめに

この記事は、実機にメモリダンプを行い、中身がどうなっているのかを勉強する目的で投稿しています。投稿者は初心者であるため、誤解していることがあればコメントをお願いします。メモリダンプについてはFTK Imager、解析にはVolatility3を使用しています。
再度言いますが、初心者です。どうか温かい目で見守ってください。

dllについて

それぞれのプロセスにはdllなるものが大体存在しています。dllを一言で言ってしまうと、ライブラリです。dllの中には関数やリソース（画像やアイコンのデータ）などが入っています。

プロセスにロードされているdllの一覧を表示するには、dlllistコマンドが有効です。

$ vol3 -f memdump.mem windows.dlllist

Volatility 3 Framework 2.28.0   PDB scanning finished

PID     Process Base    Size    Name    Path    LoadCount       LoadTime        File output

808     smss.exe        0x7ff792820000  0x37000 smss.exe        \SystemRoot\System32\smss.exe   -1      2026-03-26 00:02:28.000000 UTC  Disabled
808     smss.exe        0x7ff8072a0000  0x267000        -       -       -1      2026-03-26 00:02:28.000000 UTC  Disabled
1132    csrss.exe       0x37b900000002  0x9e5   -       -       1501    2322-06-03 17:58:48.000000 UTC  Disabled
1220    wininit.exe     0x7ff6cb350000  0xc6000 wininit.exe     C:\WINDOWS\system32\wininit.exe -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff8072a0000  0x267000        ntdll.dll       C:\WINDOWS\SYSTEM32\ntdll.dll   -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805ac0000  0xc9000 KERNEL32.DLL    C:\WINDOWS\SYSTEM32\KERNEL32.DLL        -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff803c30000  0x3f1000        KERNELBASE.dll  C:\WINDOWS\SYSTEM32\KERNELBASE.dll      -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff804680000  0x14b000        ucrtbase.dll    C:\WINDOWS\SYSTEM32\ucrtbase.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff806740000  0x382000        combase.dll     C:\WINDOWS\SYSTEM32\combase.dll 6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805640000  0xa7000 sechost.dll     C:\WINDOWS\SYSTEM32\sechost.dll 6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805520000  0x118000        RPCRT4.dll      C:\WINDOWS\system32\RPCRT4.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805d70000  0xbb000 advapi32.dll    C:\WINDOWS\SYSTEM32\advapi32.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805a90000  0x20000 imagehlp.dll    C:\WINDOWS\system32\imagehlp.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff8050b0000  0xa9000 msvcrt.dll      C:\WINDOWS\system32\msvcrt.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff803aa0000  0x29000 profapi.dll     C:\WINDOWS\system32\profapi.dll 6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff803a70000  0x2a000 bcrypt.dll      C:\WINDOWS\system32\bcrypt.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff803a50000  0x16000 wininitext.dll  C:\WINDOWS\SYSTEM32\wininitext.dll      6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff805350000  0x1c5000        USER32.dll      C:\WINDOWS\system32\USER32.dll  -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff8041a0000  0x27000 win32u.dll      C:\WINDOWS\system32\win32u.dll  -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff8057c0000  0x2b000 GDI32.dll       C:\WINDOWS\system32\GDI32.dll   6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff804550000  0x12b000        gdi32full.dll   C:\WINDOWS\SYSTEM32\gdi32full.dll       6       2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff8040f0000  0xa3000 msvcp_win.dll   C:\WINDOWS\system32\msvcp_win.dll       -1      2026-03-26 00:04:04.000000 UTC  Disabled
1220    wininit.exe     0x7ff802b80000  0x49000 SspiCli.dll     C:\WINDOWS\system32\SspiCli.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff803b80000  0xa5000 bcryptprimitives.dll    C:\WINDOWS\system32\bcryptprimitives.dll        -1      2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff8022a0000  0xf000  DiagnosticDataSettings.dll      C:\WINDOWS\system32\DiagnosticDataSettings.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802f10000  0x32000 USERENV.dll     C:\WINDOWS\system32\USERENV.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802140000  0x30000 profext.dll     C:\WINDOWS\SYSTEM32\profext.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802260000  0x30000 coreprivacysettingsstore.dll    C:\WINDOWS\SYSTEM32\coreprivacysettingsstore.dll        6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802080000  0xae000 firewallapi.dll C:\WINDOWS\SYSTEM32\firewallapi.dll     6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802030000  0x44000 fwbase.dll      C:\WINDOWS\system32\fwbase.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff805230000  0x74000 WS2_32.dll      C:\WINDOWS\SYSTEM32\WS2_32.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff802e60000  0x6b000 mswsock.dll     C:\WINDOWS\system32\mswsock.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1220    wininit.exe     0x7ff800f50000  0x29000 wtsapi32.dll    C:\WINDOWS\SYSTEM32\wtsapi32.dll        6       2026-03-26 15:58:25.000000 UTC  Disabled
1220    wininit.exe     0x7ff804340000  0x177000        CRYPT32.dll     C:\WINDOWS\system32\CRYPT32.dll 6       2026-03-26 15:58:25.000000 UTC  Disabled
1220    wininit.exe     0x7ff8033b0000  0x63000 WINSTA.dll      C:\WINDOWS\system32\WINSTA.dll  6       2026-03-26 15:58:25.000000 UTC  Disabled
1308    services.exe    0x7ff6de500000  0xd9000 services.exe    C:\WINDOWS\system32\services.exe        -1      2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff8072a0000  0x267000        ntdll.dll       C:\WINDOWS\SYSTEM32\ntdll.dll   -1      2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff805ac0000  0xc9000 KERNEL32.DLL    C:\WINDOWS\SYSTEM32\KERNEL32.DLL        -1      2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff803c30000  0x3f1000        KERNELBASE.dll  C:\WINDOWS\SYSTEM32\KERNELBASE.dll      -1      2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff805520000  0x118000        RPCRT4.dll      C:\WINDOWS\SYSTEM32\RPCRT4.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff805640000  0xa7000 sechost.dll     C:\WINDOWS\SYSTEM32\sechost.dll 6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff8037e0000  0xa000  DPAPI.dll       C:\WINDOWS\SYSTEM32\DPAPI.dll   6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff8037c0000  0x18000 EventAggregation.dll    C:\WINDOWS\SYSTEM32\EventAggregation.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff804680000  0x14b000        ucrtbase.dll    C:\WINDOWS\SYSTEM32\ucrtbase.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff803790000  0x2d000 DEVOBJ.dll      C:\WINDOWS\SYSTEM32\DEVOBJ.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff803730000  0x57000 cfgmgr32.dll    C:\WINDOWS\SYSTEM32\cfgmgr32.dll        6       2026-03-26 00:04:04.000000 UTC  Disabled
1308    services.exe    0x7ff802560000  0x95000 scesrv.dll      C:\WINDOWS\SYSTEM32\scesrv.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff8050b0000  0xa9000 msvcrt.dll      C:\WINDOWS\system32\msvcrt.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff802b80000  0x49000 sspicli.dll     C:\WINDOWS\system32\sspicli.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff802480000  0x50000 AUTHZ.dll       C:\WINDOWS\system32\AUTHZ.dll   6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff802430000  0x40000 WudfPlatform.dll        C:\WINDOWS\system32\WudfPlatform.dll    6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff803b80000  0xa5000 bcryptPrimitives.dll    C:\WINDOWS\SYSTEM32\bcryptPrimitives.dll        -1      2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff803aa0000  0x29000 profapi.dll     C:\WINDOWS\SYSTEM32\profapi.dll 6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff800fb0000  0x8000  DABAPI.dll      C:\WINDOWS\SYSTEM32\DABAPI.dll  6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ffff7260000  0x1f000 -       -       6       2026-03-26 00:04:05.000000 UTC  Disabled
1308    services.exe    0x7ff800e90000  0x9f000 -       -       -1      2026-03-26 00:04:06.000000 UTC  Disabled
1308    services.exe    0x7fffeca60000  0x29000 srvcli.dll      C:\WINDOWS\SYSTEM32\srvcli.dll  6       2026-03-26 00:04:06.000000 UTC  Disabled
1308    services.exe    0x7fffdff90000  0x5d000 capauthz.dll    C:\WINDOWS\SYSTEM32\capauthz.dll        6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8028e0000  0x1b000 kernel.appcore.dll      C:\WINDOWS\SYSTEM32\kernel.appcore.dll  6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8015f0000  0x36000 rmclient.dll    C:\WINDOWS\SYSTEM32\rmclient.dll        6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffdee00000  0x11d000        daxexec.dll     C:\WINDOWS\SYSTEM32\daxexec.dll 6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff803a70000  0x2a000 bcrypt.dll      C:\WINDOWS\system32\bcrypt.dll  -1      2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff803370000  0x30000 ncrypt.dll      C:\WINDOWS\system32\ncrypt.dll  6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8040f0000  0xa3000 msvcp_win.dll   C:\WINDOWS\system32\msvcp_win.dll       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffe95c0000  0x21000 MPR.dll C:\WINDOWS\system32\MPR.dll     6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805e70000  0xd7000 OLEAUT32.dll    C:\WINDOWS\system32\OLEAUT32.dll        6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff806740000  0x382000        combase.dll     C:\WINDOWS\SYSTEM32\combase.dll 6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffdfb80000  0x4b000 container.dll   C:\WINDOWS\system32\container.dll       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff803320000  0x3f000 NTASN1.dll      C:\WINDOWS\system32\NTASN1.dll  6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805170000  0xae000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805350000  0x1c5000        -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8041a0000  0x27000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8057c0000  0x2b000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff804550000  0x12b000        gdi32full.dll   C:\WINDOWS\SYSTEM32\gdi32full.dll       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffe23c0000  0xc4000 Windows.StateRepositoryPS.dll   C:\Windows\System32\Windows.StateRepositoryPS.dll       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffdf330000  0x6b000 AppXAllUserStore.dll    C:\WINDOWS\system32\AppXAllUserStore.dll        6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7fffeca10000  0x47000 windows.staterepositoryclient.dll       C:\WINDOWS\SYSTEM32\windows.staterepositoryclient.dll   6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ffff02e0000  0x1a000 windows.staterepositorycore.dll C:\WINDOWS\SYSTEM32\windows.staterepositorycore.dll     6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ffff7290000  0x21000 licensemanagerapi.dll   C:\WINDOWS\SYSTEM32\licensemanagerapi.dll       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805d70000  0xbb000 advapi32.dll    C:\WINDOWS\SYSTEM32\advapi32.dll        6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff802a00000  0x36000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8047d0000  0x864000        windows.storage.dll     C:\WINDOWS\SYSTEM32\windows.storage.dll 6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff8057f0000  0xf7000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805040000  0x67000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff805230000  0x74000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ff802e60000  0x6b000 -       -       6       2026-03-26 00:04:08.000000 UTC  Disabled
1308    services.exe    0x7ffffeba0000  0x17000 usermgrcli.dll  C:\WINDOWS\SYSTEM32\usermgrcli.dll      6       2026-03-26 00:04:09.000000 UTC  Disabled
1380    lsass.exe       0x7ff769c30000  0x12000 lsass.exe       C:\WINDOWS\system32\lsass.exe   -1      2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff8072a0000  0x267000        ntdll.dll       C:\WINDOWS\SYSTEM32\ntdll.dll   -1      2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff805ac0000  0xc9000 KERNEL32.DLL    C:\WINDOWS\System32\KERNEL32.DLL        -1      2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff803c30000  0x3f1000        KERNELBASE.dll  C:\WINDOWS\System32\KERNELBASE.dll      -1      2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff805520000  0x118000        RPCRT4.dll      C:\WINDOWS\System32\RPCRT4.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff803560000  0x1b7000        lsasrv.dll      C:\WINDOWS\system32\lsasrv.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff804680000  0x14b000        ucrtbase.dll    C:\WINDOWS\System32\ucrtbase.dll        -1      2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff8040f0000  0xa3000 msvcp_win.dll   C:\WINDOWS\System32\msvcp_win.dll       6       2026-03-26 00:04:04.000000 UTC  Disabled
1380    lsass.exe       0x7ff803520000  0x37000 LSAADT.dll      C:\WINDOWS\system32\LSAADT.dll  6       2026-03-26 00:04:04.000000 UTC  Disabled

たいていのdllは、C:\WINDOWS\system32,C:\WINDOWS\SYSTEM32,C:\WINDOWS\System32のパスに存在しています。これ以外のパスにdllが存在していれば少し怪しいdllのため、注意しましょう。
※出力がとっても長いので、怪しいプロセスのdll見たいなってときは、--pid <input> でgrepしましょう。（他のコマンドでも使えます）

Filescanについて

windows.filescanコマンドを使えば、メモリダンプ上に存在するすべてのファイルオブジェクトの痕跡を検出できます。もちろん先ほどのdllたちも検出可能です。ダンプできるかどうかは、そのデータがメモリ上に残っているか否かで決まります。

$ vol3 -f memdump.mem windows.filescan | head -50

Offset  Name

0xa601801f1a90  \Windows\apppatch\DirectXApps.sdb
0xcf0f4f3f6220  \$LogFile
0xcf0f4f3f6500  \$Mft::$BITMAP
0xcf0f4f3f67e0  \$Secure:$SII:$INDEX_ALLOCATION
0xcf0f4f3f6c30  \$MapAttributeValue
0xcf0f4f3f71f0  \$Mft
0xcf0f4f3f74d0  \$BitMap
0xcf0f4f3f7920  \$Secure:$SDS:$DATA
0xcf0f4f3f7a90  \Windows\SysWOW64\ntdll.dll
0xcf0f4f3f7d70  \$MftMirr
0xcf0f4f3f7ee0  TxfLog
0xcf0f4f4150d0  \CMNotify
0xcf0f551600b0  \$Directory
0xcf0f55160220  KtmLog
0xcf0f55160390  \$Secure:$SDH:$INDEX_ALLOCATION
0xcf0f55160500  \:$I30:$INDEX_ALLOCATION
0xcf0f55160670  \Device\HarddiskVolume3\$Extend\$RmMetadata\$TxfLog\$TxfLog
0xcf0f551607e0  \$Directory
0xcf0f55160da0  \$Extend\$Reparse:$R:$INDEX_ALLOCATION
0xcf0f551611f0  \$Directory
0xcf0f55161360  \Windows\System32\drivers\ja-JP\ntfs.sys.mui
0xcf0f551614d0  \$Extend\$RmMetadata\$TxfLog\$Tops:$T:$DATA
0xcf0f55161640  \Device\HarddiskVolume3\$Extend\$RmMetadata\$TxfLog\$TxfLog
0xcf0f55161920  \Windows\System32\drivers\crashdmp.sys
0xcf0f55161c00  \$Directory
0xcf0f55161d70  \$Extend\$RmMetadata\$TxfLog\$Tops
0xcf0f55161ee0  \$Extend\$RmMetadata\$Txf:$I30:$INDEX_ALLOCATION
0xcf0f5518c0b0  \$Directory
0xcf0f5518c220  \Windows\System32\drivers\cdrom.sys
0xcf0f5518c500  \Program Files\Riot Vanguard\vgk.sys
0xcf0f5518d080  \$Directory
0xcf0f5518d360  \$Directory
0xcf0f5518d640  \$Secure:$SDS:$DATA
0xcf0f5518d7b0  \$ConvertToNonresident
0xcf0f5518d920  \Windows\System32\vertdll.dll
0xcf0f5518da90  \Program Files\Riot Vanguard\Logs\vgk_2026-03-26_09-02-20.log
0xcf0f5518dd70  \$Directory
0xcf0f551c30b0  \$Directory
0xcf0f551c3220  \$Extend\$RmMetadata\$TxfLog:$I30:$INDEX_ALLOCATION
0xcf0f551c3390  \Windows\System32\drivers\stornvme.sys
0xcf0f551c3670  \$Extend\$RmMetadata\$Repair:$Corrupt:$DATA

このファイル気になるなぁと思ったらダンプしてみましょう。
windows.dumpfilesでダンプ可能です。
ダンプには仮想アドレスを指定するのがおすすめです。(--virtaddr \<アドレス>）

$ vol3 -f memdump.mem windows.dumpfiles --virtaddr <アドレス>

まとめ

短いですが、今回はメモリ上にあるdllとファイルオブジェクトについてまとめてみました。実務で使うのかは分かりませんが、CTFだとだダンプする系の問題で出てくるのかなぁという印象です。次回は、レジストリもしくはプロセスの内部構造とメモリとの関係についてやると思います。

引用

DLLって何？Windowsユーザーのためのやさしい解説
https://gainoheya.com/windows-dll/#toc1