CEIC materials

I would have had this up sooner, but I was out of town last week and the week before was the conference... Anyway, I promised I would post the slides and supporting files for my CEIC classes. I don't have the slides for the foreign language talk, but I didn't promise to give those out ;-)

How to Address ESI Involving Encryption from Disk Level to Individual Files with David Lyman [ppt | pdf]

Spoofing/hacking/memory analysis talk [pdf]

Here is the ARP spoofing perl script we used and some of you requested: [arpspoof.pl]. You must install Nemesis for the script to work, or you can modify it to use another packet crafting program. Also, depending on the distro you might have to modify the path for the arp command (for Fedora it is /sbin/arp). Anyway, you should be able to modify it on your own.

Also, we used Wireshark and Backtrack 4.

For those of you who would like more VM machines to hack into you can go to de-ice.net.

The agenda had changed somewhat for the second talk, since I had taken the class over from someone else at the last second. I would like to thank Prof Bilal Khan for all of his help and his donation of the vulnerable VM :-) Parts of this lab are representative of some of the courses in the Forensic Computing graduate program at John Jay College.

I would also like to thank AAron and Moyix from the Volatility community for their insight as well.

CEIC was a lot of fun, I met a lot of interesting people and had a blast ;-)

Some Links and Information

Well, it's been a little while since I was last writing on here. Things have been busy, but it will pick up on here soon ;-)

In the mean time, I'll post some interesting things I've come across. I am personally always looking for more information on various computer forensics/security topics. After a recent conversation with some friends of mine from the John Jay College forensics program about how one can keep up with changes in these fields, I thought I might share a few resources that I use. Hopefully some of these links will be interesting to some of you. Instead of focusing on a particular tool, I'm going to focus on the human factor: where do you find people who are interested/experts in these fields? Where can you hear them talk? Where can you interact with them? Where can you get further information about a particular subject?

Podcasts / Webcasts

There are some interesting podcasts out there. Most people already know about them, but what the heck, I'm going to list some anyway in alphabetical order:

• Cyberspeak podcast
• Exotic Liability
• Forensic 4cast
• Pauldotcom
• Sans Webcasts
• Talk Forensics

SANS' last webcast was a very good overview of what can be accomplished with memory forensics. Also Talk Forensics and PaulDotCom recently had two great podcasts with Harlan Carvey - the man of Windows Forensics. Exotic Liability is a fairly new security podcast that is as extremely interesting and entertaining. The nice thing about most of these podcasts is that you can ask questions in real time by online chat or by calling in to the show.

Forums / Listserves

Well, there are a ton of different forums/listserves for various things. Here is a short list:

Forums
• Defcon forums
• Forensic Focus Forums
• Guidance Software forum
• RegRipper forum
• Rootkit.com

Listserves
• Linux Forensics Listserv
• Metasploit Listserv
• Volatility Users and Developers Listserves
• Windows Forensics Listserv

Blogs

There are just too, too many to list. So, I'll tell you what I'll do... I'll give you my (edited) Google Feeds xml file if you are interested in finding more blogs. If you use Google Reader you can just import the file. I've tried to split things up into 3 categories: Forensics, Technical Law and Security. Some things overlap. Don't be offended if you own one of these blogs and aren't "listed correctly." One thing I like about using Google Reader is the ability to search over the blog posts. There are lots of times I remember reading something, but can't quite remember where I found it... this helps.

Twitter

Lots of computer forensics and security professionals can be found on Twitter. I've enjoyed my time on twitter talking with everyone there. Since I'm afraid to leave anyone out, I'll abstain from listing anyone at this point, but most of the people discussed above are on twitter and if you just search for security or forensics you'll end up finding a few more. Also a lot of people who maintain blogs also post links to their twitter profiles. Now of course, there is always the chance that someone could be "disinformational" either on purpose or not (Didier Stevens is not by the way ;-)) but more than likely you will learn a lot from people and will keep up with current events.

LinkedIn

In spite of some of the bad things that have happened on LinkedIn in the past, it is a very helpful tool for networking and gaining information. In addition to establishing contacts with others who are in your field, you can also join groups for your interests. There are several computer forensics and security groups on LinkedIn that are very "happening" as far as member participation. Joining is easy. Some groups may have criteria about who may join, but you can search for groups by subject and decide which ones fit your interests.

Well, that's enough for now... I'm going back to hang out on #volatility on irc.freenode.net ;-)

Briefly: CEIC 2009

I will attend and present at the CEIC conference in Orlando, FL. The agenda is available online and it looks like there will be a lot of interesting talks/labs to see and participate in. It should be fun.

Briefly: IWCMC 2009

Jarek, Prof Bilal Khan (BK) and my paper on Permeate was accepted at IWCMC 2009 Computer and Network Security Symposium. The final paper will be available at the Permeate site after some final editing.

Shouts to Jarek and BK!

Briefly: vol2html update

I have added a very small update to vol2html. Other than fixing some typos and cleaning up the code a little bit, I have added more information about DLL files.

Like the last update you can now see information about what processes have the same dll open.

There will be more... however, I think that it might be better to write a module for Volatility at this time...

Here are vol2html.pl and a new html report.

Let me know if you find any bugs :-)

The venus website is down so if you need to download vol2html you can get it from the new Google code page

PyFlag installation on CentOS 5.2 (updated)

Earlier I wrote about installing Pyflag on Fedora 8. This time, I decided to go for the CentOS install.

First off, this tutorial is not for the faint of heart and as always I take no responsibility if things go wrong on your end.

I got tired of trying to get darcs installed on my CentOS box and instead downloaded the PyFlag tarball. The first thing you will have to do is update Python on your box - I installed 2.6.1 by source.

You must also install all packages mentioned earlier including MySQL for Python and Sleuthkit:

# yum install python-dateutil clamav clamav-server \
mysql mysql-devel mysql-server file-devel python-expect \
zlib zlib-devel openssl python-imaging

You may have a problem when you install MySQL for Python, however, when it tries to download the setuptools-*.egg file. If you have Python version 2.6 installed you need the following egg file:

setuptools-0.6c9-py2.6.egg.

You can download this into your MySQL-python-1.2.2 directory and change the name to setuptools-0.6c5-py2.6.egg or you can muck around with the ez_setup.py file. However you want to do it.

# python2.6 setup.py build
# python2.6 setup.py install

Now, if you have Python 2.6 installed in addition to your default Python installation, you'll have to copy over some libraries to the new location e.g.

# cp -R /usr/lib/python2.4/site-packages/pexpect.py* \
/usr/local/lib/python2.6/site-packages/

# cp -R /usr/lib/python2.4/site-packages/PIL \
/usr/local/lib/python2.6/site-packages/

# cp -R /usr/lib/python2.4/site-packages/python-dateutil \
/usr/local/lib/python2.6/site-packages/

# cp /usr/lib/python2.4/pyexpect.py* \
/usr/local/lib/python2.6/

At this point you should be set to begin PyFlag installation.

# ./configure
# make install

At that point you are set to run PyFlag. Don't forget to set up MySQL:

# /sbin/chkconfig mysqld on
# /sbin/service mysqld start
# mysqladmin -u root password 'new-passwd'

You must use quotes around the new-passwd you choose, and don't forget what it is!

Then start PyFlag by typing "pyflag" (without quotes) at the commandline.

By default PyFlag listens on port 8000. So simply open your browser and go to http://127.0.0.1:8000 You can modify settings at this point:



You will then have to initialize the database:



After which you will see a success message:



Now you are ready to start a new case, which you can do under case management.



Give the case a name:



and then you will see confirmation that your case is created:



Now you can load your evidence. In this case, I am loading a USB image. Type 0 (zero) for the offset and give your evidence some unique name you'll remember and press submit.



If things work out, you will Sleuthkit will identify the file system type in a mount point (this could be anything, I'm using /usb but it could be D: or whatever):



You will then see the uploading dialog.



Note: DO NOT BE IMPATIENT! Let it finish uploading. You will notice that it will refresh every now and then as it uploads more from the filesystem. It will then redirect to the analysis screen. You can now browse the filesystem:

Briefly: IDA Pro on CentOS 5.2

This is almost a non-post, but who knows, it might be useful to someone... So today I while installing Ida Pro on CentOS, I hit a small snafu. Everything went well for key extraction: here's a nice tutorial for that. However after I retrieved the key, I placed it according to the README file in the $HOME/.idapro directory.

However, when running it I was faced with the following problem:

$ ./idal
./idal: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory

I noticed that my library was incompatible since it was libstdc++.so.6. Luckily, there are ``compat'' packages that contain these older libraries. You can install them with yum:

# yum install -y compat-libstdc++-33.i386

At this point, IDA Pro starts up nicely:

Some Brief BH DC Afterthoughts

Though it's almost too late for this, I thought I would write briefly on BH DC. I had a blast while I was there and there were some very interesting talks. In case you are interested in the content of these talks, slides, papers, demos and videos are being uploaded to this site:

https://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html

The talks I liked the most were:


Let Your Mach-0 Fly by Vincenzo Iozzo

This talk describes how to replace a running process in memory with another by unmapping the current process, replacing the header and enveloping the old process with the new process. It was really cool to see the demos, but if you watch the video (if it is uploaded), you will see he has trouble with the safari example. I didn't have time to confirm my suspicions, but I thought this is because he didn't supply the entire path to the desired executable. I came to him after the talk to ask about this, but things were so rushed at the end that I didn't get a chance to ask. I emailed him and he replied: ``I found the problem, I forgot to patch a known bug before my talk,'' so he seems to have found the problem. The code for this one is available online.

New Techniques for Defeating SSL/TLS by Moxie Marlinspike

I wasn't completely sure at first that this was going to be an interesting talk, but it turned out very nice. The title is misleading in that it wasn't really about SSL in general but about https specifically. He has a tool that can MITM connections by
stripping out references to https to http. While that is not as interesting, the more interesting part comes into play with the creation and usage of fake certificates to make things "secure". It was also funny how he used the favicon feature to make give a positive indicator by switching it with a padlock. I'm not sure how effective it would be against items like Yahoo!'s sign in seal (among others), but there are other interesting possibilities. The code for his presentation is also available online. (updated link)


Attacking Intel(R) Trusted Execution Technology by Joanna Rutkowska
and Rafal Wojtczuk

This was an awesome talk. It was a pleasure to see this team of famous researchers talk about the intense of TXT and how they could exploit it. The video for this one is up, it would definitely be worthwhile to watch it. The video for this one is available online. Joanna has also posted the videos from the slides here:
http://theinvisiblethings.blogspot.com/2009/02/attacking-intel-txt-paper-and-slides.html

Defending Against BGP Man-In-the-Middle Attacks by Earl Zmijewski

This was another awesome talk! I didn't know the fine details about routers before the talk, but the MITM attack is quite simple. It was also very interesting to see how they came to a solution for detecting these attacks. It was also interesting that there after they had refined their detection algorithm they only found three instances of the attack "in the wild", all of which could be explained. Another must read/watch I think, and Earl is entertaining :-)

Blackhat DC

Looks like I'll be attending Blackhat DC this week. Should be fun. Not sure if I want to do the picks thing... but there are some interesting talks scheduled.

I will probably be sticking mainly to Track 2 talks, (with some exceptions) however...

PTK on CentOS 5.2

Having some spare time over the weekend caused me to attempt an installation of PTK on my spare CentOS box. I've succeeded in getting it to run under Fedora, so I had a little bit of an idea of what I was getting myself into...

Before you get started, make sure you have the following packages installed:

mysql
mysql-server
php
php-mysql
php-mbstring
httpd
Sleuthkit

If you need EWF or AFF support you can install them from:

libewf
afflib

After installing everything, you need to initialize MySQL (as root):

# /sbin/chkconfig mysqld on
# /sbin/service mysqld start
# mysqladmin -u root password 'new-passwd'

You must use quotes around the new-passwd you choose, and don't forget what it is!

You must also start the http server(as root):

# /sbin/service httpd start

Now you are ready to download and install PTK from sourceforge. I downloaded version 1.0.5.

In order to install PTK, extract the tarball in your webserver directory as root:

# cd /var/www/html
# ls
ptk-1.0.5.tar.gz

# tar -xzf ptk-1.0.5.tar.gz
# chown -R apache.apache ptk

The last command above makes sure that all files are owned by the webserver user.


Now we have address a problem that still exists regarding the installation script. Go inside the ptk folder. At this point, you should see the install.php script. If you have Sleuthkit installed in /usr/local/bin the install script will not work as expected because this is not in its path. You can find out where it is installed by typing which plus one of the Sleuthkit commands e.g.:

$ which istat

If the path returned is /usr/local/bin then you can modify the install.php file by changing entries like:

$istat = shell_exec("which istat");

to

$istat = shell_exec('export PATH="/usr/bin:/usr/local/bin"; which istat');

and so on...

If all goes well, you will get to the options screen, which should look something like the following:



Fill everything out as you like (including distro) and press next. Now, when I installed PTK under Fedora, everything was ready to go at this point. With CentOS, it was another story. For some reason, things did not get updated with the extra configure scripts.

So, you have to manually add the locations for your Sleuthkit executables in the following files:

config/conf.php
config/conf.pl

where config is the folder within the ptk folder [/var/www/html/ptk/config]. If you open up conf.pl it may look like:

installdir => '/var/www/html/ptk/',
md5_bin => '/usr/bin/md5sum',
sha1_bin => '/usr/bin/sha1sum',
fsstat_bin => '',
mmls_bin => '',
fls_bin => '',
istat_bin => '',
[snip]

Notice that there are some blank entries. Therefore you will have to enter the correct path for those executables.

All right, so I'm not going to make you do it... :-) Here are the modified files for my CentOS box. Just make sure you put then in the right places, and you might have to chown them as well.

Enjoy! and hope this helps someone out there...

Hash of a CD

Recently I had to see if two CDs were identical. I had the hash value of the iso for the desired content so I decided to check the hash for both CDs. There is really not that much to this post, but just in case someone ever needs to know how to do this I'll give you the command line how-to.

In my case, md5sum /dev/cdrom did not work. Now there is no reason to copy the CD to an iso file in order to do this. You can just use dd and pipe the output into md5sum or sha1sum.

I found that just doing a straight dd without extra options did not work. So you should use isoinfo to get the logical block size and the volume size to feed to dd (bs="Logical block size" and count="Volume size"). I decided to put this all into a bash script you can find here. The code is shown below:

INFO=`isoinfo -d -i /dev/cdrom \
|awk '{ if ($1 ~ /Volume/ && $2 ~ /size/ ) print $4; \
else if ($1 ~ /Logical/ && $2 ~ /block/ && $3 ~ /size/) \
print $5 endif }'`

INFO=($INFO)

echo "Logical block size: ${INFO[0]}"
echo "Volume size: ${INFO[1]}"
echo "Now executing: "
echo "dd if=/dev/cdrom bs=${INFO[0]} count=${INFO[1]} conv=notrunc,noerror,sync | md5sum"

dd if=/dev/cdrom bs=${INFO[0]} count=${INFO[1]} \
conv=notrunc,noerror,sync | md5sum

It's not the most beautiful solution, but there it is. This uses md5, for other hashes just modify the script as needed. Also if your CD device is not /dev/cdrom modify that as well.

Practitioner's Guide to Capturing and Analysis of RAM

This is a late post, but I've been busy... I learned about this video from Moyix on the Volatility irc channel (#volatility on freenode). It's nice that people like vol2html. It encourages me to add more to it...

There's more info here if you are interested. I'm glad to see that memory analysis is getting more visibility. Cool stuff! Enjoy!


Dale Beauchamp - DojoSec January 2009 from Marcus Carey on Vimeo.

vol2html.pl update

I made a small update to vol2html.pl. Since there are a lot of html files being generated, I thought it might be nice to allow the user to specify an output directory. So there is an extra (optional) option:

-D <output_dir>

if you want to print all html files to the another directory. If the directory does not exist, it is created. The script currently does not check if files exist in this directory and will clobber any files with the same name.

I have also added some more information about the open files. You can now see all processes that have the same open files and how many times each process has a file open. To do this, click on the process of interest and click open files. Each file name is linked to a report, which contain a list of all processes (by pid) that have the file open and how many times that process has the file open. There is a link to each pid as well.



Also new there is a link to the index.html file at the end of each report.

Since my website is down for now, you can get the updated script here. (updated 1/11/09 and moved from google code which was messing up some things)

Hopefully this is helpful.

Another update: Here's a second report to look at.

The venus website is down so if you need to download vol2html you can get it from the new Google code page

Still more to come....

OT: Twitter

So I finally broke down and created a Twitter account recently. It started when I began watching a few people on Twitter. They often had very interesting Tweets related to my interests. After a while I realized that it would be easier to keep up with these Tweets by following these people with my own Twitter account.

Now, the reason I haven't had one up to this point was mostly because I was afraid of the privacy issues. While teaching undergraduate classes I have often been asked if I have a Facebook, Myspace, Twitter (or whatever) account so that students could ``befriend'' me. Till now I have abstained from these types of accounts mostly to avoid these types of student/teacher online friendships. Not that I dislike my students (I don't), but I just figured it might get uncomfortable at some point.

I am wondering if others have struggled with this issue. I know there are some people on Twitter who teach classes like me...

I have made my Tweets private for now to make sure that I know who is following me (but can you ever *really* know?). I know this is probably not the most favorable setup, but it makes me feel somewhat better that my inconsequential Tweets are not just openly exposed to everyone.

The people on Twitter are cool and information they give rocks. So far I am really enjoying it :-)

VMWare Workstation machine to VMWare Server

Recently I received a VMWare image to work on. I had installed VMware Server 1.0.8 on my CentOS 5.2 laptop because 2.0 is just painful. Unfortunately the image had been created with a newer version of Workstation rendering it incompatible with my install. I found the VMware converter, but it wasn't much help since I'm on a Linux machine.

I created a new default machine using VMware Server with the basic settings matching that of the target machine, copied the resulting .vmx file into the folder of the target machine. (I could have just modified the original .vmx file, but just decided to start over cleanly.)

So now the vmware machine tries to boot, but fails with the following message:

One or more of your disk files were created by a more recent version of VMware software and are not supported by this version of VMware Server.

Then I modified the vmdk descriptor file from:

ddb.virtualHWVersion = "7"

to

ddb.virtualHWVersion = "4"

Worked like a charm :-)

I don't know if this will work in every case, but it might be helpful to someone.

Vol2html Perl Script

During my forensics class I started thinking of a way to make it easier for my students to sort through the output of Volatility and starting writing a little perl script to create an html report of running processes, open files and dlls.

This is not finished as there is more information that I would like to correlate from the output of Volatility. But if you are somewhat curious, this is what I have so far: vol2html.pl. You can see an example report here. The output files for this report and the perl script are bundled together here. There is minimal error checking.

To use, first redirect the output of Volatility for pslist, dlllist and files to text files:

./volatility pslist -f mem.dd > pslist.txt
./volatility files -f mem.dd >files.txt
./volatility dlllist -f mem.dd >dlllist.txt

Then feed the perl script these files:

./vol2html.pl -pslist pslist.txt \
-files files.txt -dlllist dlllist.txt

There is more coming...


The venus website is down so if you need to download vol2html you can get it from the new Google code page

Permeate MITM

It's been a long while. For that I apologize... I guess I'm not a very good blogger when the semester is in full stride. Anyway, there's a new code release for Permeate, this time with the MITM detection built in. A paper we recently submitted to ICC 09 is available there as well. Shouts to Jarek and BK :-)

Enjoy!

PTK 0.2 Patch

In case you missed it, I've created a patch for PTK. You can find it here. This fixes the path issue for those who have Sleuthkit installed in /usr/local/bin. PTK 1.0 will be released soon and this will no longer be an issue.

PolyTech forensics challenge

Yay! Another former student, Fausto Dutan, is in the finals (one got third place last year). There's also a MS student from John Jay - Richard Alcalde. Go CUNY :-) Good luck to all of the finalists.

Edit 10/17: Richard Alcalde got 1st place! Congrats Richard :-)

/proc/kcore part II

It will take me a few posts to go through the kcore file... The last kcore post dealt only with ELF headers of the kcore file. After the ELF header ends, there are 3 program headers:

From elf.h we see that the structure of a program header is:

typedef struct
{
 Elf32_Word    p_type;                 /* Segment type */
 Elf32_Off     p_offset;               /* Segment file offset */
 Elf32_Addr    p_vaddr;                /* Segment virtual address */
 Elf32_Addr    p_paddr;                /* Segment physical address */
 Elf32_Word    p_filesz;               /* Segment size in file */
 Elf32_Word    p_memsz;                /* Segment size in memory */
 Elf32_Word    p_flags;                /* Segment flags */
 Elf32_Word    p_align;                /* Segment alignment */
} Elf32_Phdr;

A look at the first program header below:

0000030: 0000 0000 0400 0000 9400 0000 0000 0000  ................
0000040: 0000 0000 d807 0000 0000 0000 0000 0000  ................
0000050: 0000 0000

The first program header is of type PT_NOTE (Auxiliary info) which has a value of 0x4
We can see that the offset is 0x94
The filesize has a value of 0x7d8

All other parts of the struct are set to 0x0

A look at the second program header below:

0000050: 0000 0000 0100 0000 0010 8038 0000 80f8  ...........8....
0000060: 0000 0000 00e0 ff06 00e0 ff06 0700 0000  ................
0000070: 0010 0000

The type is of type PT_LOAD 0x1 (loadable program segment)
The offset is 0x38801000
vaddr is 0xf8800000 (vmalloc)
filesz and memsz are both 0x6ffe000
flags are 0x7 (PF_R | PF_W | PF_X)
page alignment is 0x1000 (size of a page - 4096)

The other remaining part of the structure (p_paddr) is 0x0

The third program header looks like:

0000070: 0010 0000 0100 0000 0010 0000 0000 00c0  ................
0000080: 0000 0000 0000 0038 0000 0038 0700 0000  .......8...8....
0000090: 0010 0000

The type is of type PT_LOAD 0x1 (loadable program segment)
The offset is 0x1000 (size of a page - 4096)
vaddr is 0xc0000000 (start of lowmem)
filesz and memsz are both 0x38000000 (size of (kcore-4096))
flags are 0x7 (PF_R | PF_W | PF_X)
page alignment is 0x1000 (size of a page - 4096)

The other remaining part of the structure (p_paddr) is 0x0

From my messages file to compare:

Sep 15 12:28:57 kanga kernel:
Memory: 2060724k/2087616k available
(2252k kernel code, 25548k reserved, 1182k data, 284k init, 1170112k highmem)
Sep 15 12:28:57 kanga kernel: virtual kernel memory layout:
Sep 15 12:28:57 kanga kernel:     fixmap  : 0xffc53000 - 0xfffff000   (3760 kB)
Sep 15 12:28:57 kanga kernel:     pkmap   : 0xff400000 - 0xff800000   (4096 kB)
Sep 15 12:28:57 kanga kernel:     vmalloc : 0xf8800000 - 0xff3fe000   ( 107 MB)
Sep 15 12:28:57 kanga kernel:     lowmem  : 0xc0000000 - 0xf8000000   ( 896 MB)
Sep 15 12:28:57 kanga kernel:       .init : 0xc0761000 - 0xc07a8000   ( 284 kB)
Sep 15 12:28:57 kanga kernel:       .data : 0xc063337f - 0xc075ab88   (1182 kB)
Sep 15 12:28:57 kanga kernel:       .text : 0xc0400000 - 0xc063337f   (2252 kB)

Notes

The next three sections will use this structure:

struct memelfnote
{
        const char *name;
        int type;
        unsigned int datasz;
        void *data;
};

Looking at the first note (only the interesting part, the rest is zeroed out):

0000090: 0010 0000 0500 0000 9000 0000 0100 0000  ................
00000a0: 434f 5245 

In this case the items shown are not in the same order of the struct. This is because they have been placed in a slightly different order.

First we have the size of the name: 0x5 (strlen(CORE)+1)
Then the data size: 0x90 (size of elf_prstatus struct)
Then the type: 0x1 (NT_PRSTATUS)
Then the name itself: CORE
And finally the data, which has been zeroed out (not shown).

The next note looks like the following:

      
                            0500 0000 7c00 0000  ............|...
0000140: 0300 0000 434f 5245 0000 0000 0052 0000  ....CORE.....R..
0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000160: 0000 0000 0000 0000 766d 6c69 6e75 7800  ........vmlinux.
0000170: 0000 0000 0000 0000 726f 2072 6f6f 743d  ........ro root=
0000180: 2f64 6576 2f56 6f6c 4772 6f75 7030 302f  /dev/VolGroup00/
0000190: 4c6f 6756 6f6c 3030 2072 6867 6220 7175  LogVol00 rhgb qu
00001a0: 6965 7400 0000 0000 0000 0000 0000 0000  iet.............
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001c0: 0000 0000 0000 0000 

First we have the size of the name: 0x5 (strlen(CORE)+1)
Then the data size: 0x7c (sizeof(struct elf_prpsinfo))
Then the type: 0x3 (NT_PRPSINFO )
Then the name itself: CORE
And finally the data, which uses the elf_prpsinfo structure:

struct elf_prpsinfo
{
       char    pr_state;       /* numeric process state */
       char    pr_sname;       /* char for pr_state */
       char    pr_zomb;        /* zombie */
       char    pr_nice;        /* nice val */
       unsigned long pr_flag;  /* flags */
       __kernel_uid_t  pr_uid;
       __kernel_gid_t  pr_gid;
       pid_t   pr_pid, pr_ppid, pr_pgrp, pr_sid;
       /* Lots missing */
       char    pr_fname[16];   /* filename of executable */
       char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
};

The data consists of:
pr_state 0x0
pr_sname 0x52 (R)
pr_zomb 0x0
Executable file name (pr_fname) "vmlinux"
Saved command line (pr_psargs) up to 80 characters
ro root=/dev/VolGroup00/LogVol00 rhgb quiet

The rest is zeroed out from a memset command

The third note denotes information about the current task. Here is part of it:

        
                            0500 0000 9006 0000  ................
00001d0: 0400 0000 434f 5245 0000 0000 0000 0000  ....CORE........
00001e0: 0020 b2f0 0200 0000 0021 4000 ffff ffff  . .......!@.....
00001f0: 7800 0000 7800 0000 7800 0000 b086 8af0  x...x...x.......
0000200: b086 8af0 4072 63c0 0004 0000 0000 4000  ....@rc.......@.
0000210: 0100 0000 0000 0000 0000 0000 0100 0000  ................
0000220: 494c 6a33 c10a 0000 2fd2 1d00 0000 0000  ILj3..../.......
0000230: 85b4 abc6 0c01 0000 6134 0c00 0000 0000  ........a4......
0000240: 0000 0000 0000 0000 5669 0d00 0000 0000

First we have the size of the name: 0x5 (strlen(CORE)+1)
Then the data size: 0x690 (sizeof(struct task_struct) found in linux/sched.h)
Then the type: 0x4 (NT_TASKSTRUCT )
Then the name itself: CORE
And finally the data, which consists of `current' which is the current thread (not shown above).

Now we must dissect task_struct info, which we'll do a bit later...