Volatility3 not work - symbol and pdb problem about volatility3 HOT 18 OPEN

I want to know how to solve this problem. Please give the solution steps.

from volatility3.

Please ensure you include the output of volatility run with -vvv as mentioned in the instructions when filing a bug...

from volatility3.

Please ensure you include the output of volatility run with -vvv as mentioned in the instructions when filing a bug...

Sorry, I don't understand what you mean. Is that right?

from volatility3.

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

from volatility3.

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

Thank you for your advice. Also, I have vmss files in my folder. Now there are the following problems, how to solve them?

from volatility3.

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

In addition, it was able to run normally a few days ago, but suddenly there was a problem these days.

from volatility3.

@ysl2000 did you cloned the recent version and end up with this issue? I am also facing the same. It was working 25 days back but now i end up with same issue.

from volatility3.

@ysl2000 did you cloned the recent version and end up with this issue? I am also facing the same. It was working 25 days back but now i end up with same issue.
Yes, I do! I changed the path of the entire file, copied it to another location, and then it didn't work. How can I solve it?

from volatility3.

Hi, could you try running --clear-cache right after the -vvv option ?

from volatility3.

Hi, could you try running --clear-cache right after the -vvv option ?

Still not working.

from volatility3.

By supplying screenshots rather than copying the text of the output, it makes it very difficult to search and to copy/paste particular text from the output. When reporting bugs in the future, please always copy and paste text and do not include screenshots of text, it slows everything down.

There may be an issue with clearing the cache, in which case --clear-cache may also not solve the problem. To verify whether thats the case, please use --clear-cache and let us know whether that helps. If it doesn't, you'll need to delete the entire directory C:\Users\ysl.PC-20231112KYCE.000\AppData\Roaming\volatility3 (which may have a mistake because it retyped from the image, rather than copy pasting from the output). If you need to do that, please also report back whether that then solves the problem, and if so we can improve the --clear-cache function. Thanks...

from volatility3.

By supplying screenshots rather than copying the text of the output, it makes it very difficult to search and to copy/paste particular text from the output. When reporting bugs in the future, please always copy and paste text and do not include screenshots of text, it slows everything down.

There may be an issue with clearing the cache, in which case --clear-cache may also not solve the problem. To verify whether thats the case, please use --clear-cache and let us know whether that helps. If it doesn't, you'll need to delete the entire directory C:\Users\ysl.PC-20231112KYCE.000\AppData\Roaming\volatility3 (which may have a mistake because it retyped from the image, rather than copy pasting from the output). If you need to do that, please also report back whether that then solves the problem, and if so we can improve the --clear-cache function. Thanks...

Sorry, using --clear-cache doesn't work either. And I did not find the path file you mentioned in drive C.

from volatility3.

The AppData directory is usually hidden, but I've made an update to ensure the cache is fully cleared during run, rather than the quick clear it does at the moment. Please ensure you're using commit 35c58372 and try the --clear-cache option again.

from volatility3.

The AppData directory is usually hidden, but I've made an update to ensure the cache is fully cleared during run, rather than the quick clear it does at the moment. Please ensure you're using commit 35c58372 and try the --clear-cache option again.
I'm sorry, but the solution you proposed still doesn't solve the problem. Or is there something wrong with my orders? Could you please help me guide it again?

from volatility3.

from volatility3.

commit 35c5837

Thank you for your guidance. I don't know how to use commit 35c5837, but I re-downloaded volatility after your update. Although version 2.5.0 is still not working, version 2.7.0 is available.

from volatility3.

It's in the live development version. You can either wait for our next release or you can click on the green code button on the front page of our github site, and click download to get the latest development version. We need to roll a new release soon, but we haven't determined a date for that yet.

from volatility3.

It's in the live development version. You can either wait for our next release or you can click on the green code button on the front page of our github site, and click download to get the latest development version. We need to roll a new release soon, but we haven't determined a date for that yet.

Okay, thank you.

from volatility3.