Comments (15)
Could you run vol with the -vvv option before the plugin name and share the log output as text and not an image. It really helps work out what's going on.
from volatility.
A quick note, vol3 doesn't need you to choose a profile. It'll find it automatically.
from volatility.
C:\Users\W0457579\Documents\volatility-master\volatility-master>
C:\Users\W0457579\Documents\volatility-master\volatility-master>
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP0x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win2008R2SP0x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win2008R2SP1x64_24000 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win2008R2SP1x64_23418 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win2008R2SP1x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP1x64_24000 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP1x64_23418 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
0xfffffa8006d26890: 0 0 0 ------ 1970-01-01 00:00:00 UTC+0000
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP1x64 pslist
Volatility Foundation Volatility Framework 2.6.1
Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
0xfffffa8006d26890 0 0 0 -------- ------ 0
C:\Users\W0457579\Documents\volatility-master\volatility-master>
does this work better?
from volatility.
and i understand but i simply wish to work out whats wrong with 2.6
from volatility.
Please use the -vvv option so that more logs are made and upload that.
Vol3 has a 2.6.1 version, or do you mean you're trying to run the old python2 framework? If so you'll have more luck raising an issue there.
Edit: yes sorry. I see you are using the old framework. You'll be better off raising an issue there.
from volatility.
how do i use the -vvv option?
from volatility.
To use -vvv with the newer framework you would do this.
Vol.py -f image.vmem -vvv windows.pstree
I'm not sure about extra logging with the older framework, you're better off raising an issue there if yiu want help understanding that.
I'd really encourage you to use the newer framework.
from volatility.
C:\Users\W0457579\Documents\volatility-master\volatility-master>python vol.py -f "Clone of Clone of Windows 7 x64-a88debbd.vmem" --profile=Win7SP1x64 -vvv pslist
Volatility Foundation Volatility Framework 2.6.1
Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
0xfffffa8006d26890 0 0 0 -------- ------ 0
C:\Users\W0457579\Documents\volatility-master\volatility-master>
alright here's what i was able to find
from volatility.
also where do you reccomend i ask this issue?
from volatility.
Yes, that is the older Framework. I can't personally help you with that. You'll have more luck using the newer framework or raising an issue on the older frameworks page.
This isn't an issue with vol3.
from volatility.
where's the older frameworks page?
from volatility.
https://github.com/volatilityfoundation/volatility
from volatility.
how do i comment on the page since im not seeing the option to do so?
from volatility.
In exactly the same way you created this issue, just on that project instead https://github.com/volatilityfoundation/volatility/issues
GitHub guide:
https://docs.github.com/en/issues/tracking-your-work-with-issues/creating-an-issue
I'd really recommend using the newer framework.
from volatility.
Please keep in mind that volatility 2 is no longer supported and was last updated 4 years ago. You'd be better advised trying to get volatility 3's pslist to work on the memory image you have.
from volatility.
Related Issues (20)
- profile issue in Ubuntu 21.04 while using volatility 2.6 HOT 1
- A translation layer requirement was not fulfilled | A symbol table requirement was not fulfilled
- volatility keeps giving me this messege
- 各位大佬能帮我看下是什么原因吗,用filescan指令时扫到乱码就会报错 HOT 1
- building dwarf2json - go build fails
- ValueError: invalid literal for int() with base 16: '128 (-128)' HOT 4
- Extract images
- 'yara.StringMatch' object is not iterable HOT 1
- No results from plugin windows.handles.Handles HOT 1
- handles page error?
- KeyError: '__int128' with ARM64
- "ArmAddressSpace - EXCEPTION: 'state'"
- Missing parentheses HOT 1
- Infinite determinating profile
- How to plugin other tools for volatility windows version?
- PSTREE error HOT 3
- windows.dumpfiles doesn't return anything.
- no suitable address space mapping found
- Failed to import volatility.plugins.chromehistory HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from volatility.