Comments (9)
Forgot to add... The host machine is 64 bit windows 7 running python 2.7
Original comment by [email protected]
on 17 Aug 2010 at 11:14
from volatility.
Yep, this can be recreated with any Windows 7 image and psscan plugin. It
appears this plugin looks for the WorkingSetLock attribute of an _EPROCESS,
which isn't defined for Vista/7.
Original comment by [email protected]
on 17 Aug 2010 at 11:17
from volatility.
Ok, so Vista and 7 don't have a WorkingSetLock, and there's something else at
the same offset, so we're going to have to change how psscan finds/validates
potential _EPROCESS objects. That's probably something for mooyix or
labarumXP, so I'm assigning it to them.
Original comment by [email protected]
on 17 Aug 2010 at 11:23
from volatility.
Original comment by [email protected]
on 18 Aug 2010 at 10:36
- Changed title: psscan relies on WorkingSetLock which isn't in vtypes for windows 7 x86 images
from volatility.
Original comment by [email protected]
on 26 Aug 2010 at 11:25
- Changed state: Accepted
from volatility.
Original comment by [email protected]
on 21 Jan 2011 at 9:03
- Added labels: Milestone-Release1.4
from volatility.
Sorry for the bugspam, but better to get this right now than later once it's
more in use.
Original comment by [email protected]
on 4 Feb 2011 at 9:34
- Added labels: Milestone-1.4.x
- Removed labels: Milestone-Release1.4
from volatility.
It looks as though the DispatchHeader scanner (psscan) is slower than the Pool
scanner (psscan2) and only turns up results that psscan2 doesn't in very
specific situations (such as the Idle "process" and malware that's capable of
messing with anything it pleases, in which case it could avoid psscan as well).
We're therefore going to move psscan into the contrib directory, and rename all
the remaining "scan2" plugins into "scan" plugins. The descriptions may need
updating to make them more accurate. I'll make sure psscan details that it
scans for pool headers, but more than that I'll need other people to
comment/patch/shout at me on IRC... 5:)
Original comment by [email protected]
on 21 Jun 2011 at 7:12
from volatility.
This issue was closed by revision r1003.
Original comment by [email protected]
on 21 Jun 2011 at 7:43
- Changed state: Fixed
from volatility.
Related Issues (20)
- python tools/mac/convert.py converted-10.9.4.64bit.dwarfdump > 10.9.4.64bit.vtypes results in KeyError: 'AT_data_member_location' HOT 3
- Volatility 2.4 fails to decompress win8 hiberfil.sys HOT 2
- Cannot run the 'make' command HOT 19
- Unable to obtain password hashes HOT 1
- KiFastSystemCall I want to know where is next step? HOT 2
- Error when I make profile in Window 8 Pro (64 bits) HOT 1
- Except psscan no other cmds are working HOT 1
- Getting several "no such option" errors HOT 1
- Volatility was functioning, now errors out HOT 1
- Running VF from Jython HOT 2
- Failed to import volatility.plugins.overlays.linux.linux (ValueError: too many values to unpack) HOT 2
- File new issues on github: https://github.com/volatilityfoundation/volatility/issues HOT 17
- yarascan fails to ececute grep expression (attached) HOT 4
- imageinfo takes forever HOT 1
- How to know the device is using by how many processes in the computer system ? HOT 1
- Error adding new plugin in 2.3.1 HOT 2
- Cant run volatility command Pslist from Eclipse(python IDE) HOT 1
- "This command does not support the profile" Error HOT 1
- Volatility Standalone for Windows incorrectly states profile is invalid HOT 2
- Volatility /tools/linux 'make' not working
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from volatility.