Comments (7)
Thanks for reporting this. Since the output's already been posted to slack, I'll post a copy here too to keep everything together:
From the error message and the output it looks like a runaway string
Traceback (most recent call last):anning primary2 using PdbSignatureScanner
File "vol.py", line 10, in <module>
volatility.cli.main()
File "C:\Users\admin\Desktop\volatility3-master\volatility\cli\__init__.py", line 523, in main
CommandLine().run()
File "C:\Users\admin\Desktop\volatility3-master\volatility\cli\__init__.py", line 281, in run
renderers[args.renderer]().render(constructed.run())
File "C:\Users\admin\Desktop\volatility3-master\volatility\cli\text_renderer.py", line 161, in render
grid.populate(visitor, outfd)
File "C:\Users\admin\Desktop\volatility3-master\volatility\framework\renderers\__init__.py", line 202, in populate
accumulator = function(treenode, accumulator)
File "C:\Users\admin\Desktop\volatility3-master\volatility\cli\text_renderer.py", line 156, in visitor
accumulator.write("{}".format("\t".join(line)))
File "C:\Users\admin\AppData\Local\Programs\Python\Python37\lib\encodings\cp1252.py", line 19, in encode
return codecs.charmap_encode(input,self.errors,encoding_table)[0]
UnicodeEncodeError: 'charmap' codec can't encode character '\u03e5' in position 68: character maps to <undefined>
All the code paths seem to return unicode strings (which should therefore already have been converted with the replace
error strategy), apart from the process_name
variable which uses utility.array_to_string
which may be unbounded, although that should be bounded by the array size, which I think is always 16? We might want to push an explicit limit on the string at that point?
from volatility3.
@yehias Sorry for the delay. Do you still have access to this memory sample? If we produce a debug branch of Volatility, would you be able to run a couple additional commands and share the output?
from volatility3.
Also, interestingly, using iconv on linux to convert UTF-16 to ASCII works just fine on the handles.txt file and displays the entire thing without errors? Opening the original handles.txt causes gedit to throw an error somewhere in the middle (at almost exactly 0x3a000, which may therefore just be some kind of buffer limit?). It would be really good to get the direct and complete output of running the command too, so by adding something like > output.txt
on the end.
from volatility3.
@iMHLv2 sorry for late reply i've been busy with some cases actually I don't have it anymore but I can replicate it again I was using it on windows 10 lab still have the machine so let me know which commands you need me to run and I will memory sample per command for reference
from volatility3.
@yehias If you're able to reproduce this again within your lab, would you be able to share that clean/non-sensitive memory dump? Unfortunately its not as easy as sending you some commands to run like I initially hoped. If that's definitely not going to be possible, can you tell us what install media you used to build the VM and if there's any customizations needed to produce the issue (i.e., any special language packs installed)?
from volatility3.
We haven't heard back in a while, if you're still encountering this issue please feel free to reopen it. 5:)
from volatility3.
from volatility3.
Related Issues (20)
- Not able to download requirements.txt for Volatility 3-1.0.0 HOT 1
- Ubuntu 22.04 Unresolved Reference HOT 7
- linux: `module_layout` is replaced by `module_memory` as of 6.4 HOT 6
- Custom Linux kernel : Unable to validate the plugin requirements when a custom profile has been created and detected. HOT 26
- PluginRequirements should not be fulfilled unless their PluginRequirements are fulfilled
- windows.handles.Handles not working HOT 5
- Potential support of minidump formats from processes? HOT 8
- syntaxwarning on python 3.12 HOT 3
- Can't process a Windows 10 64bit Crash Dump HOT 9
- Volatility 3 shows no results on my android Memory dump HOT 42
- When scanning linux lime memory file, use the config file created by --save-config, can not skip the scan LimeLayer step. Is this normal behavior? HOT 4
- Implement tmpfs plugin HOT 3
- Extract complete executable command in linux.pslist HOT 8
- Error outputting file when attempting to `--dump` processes in `linux.pslist` HOT 12
- A symbol table requirement was not fulfilled. HOT 10
- README: Link to license is broken HOT 1
- Volatility Plugin Requirements HOT 4
- ProcessHeaps access problems HOT 11
- Volatility3 not work - symbol and pdbconv problem HOT 2
- Symbols are not picked up HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from volatility3.