Hi Folks,
I've got a possible bug in Volatility. (Assuming Volatility is
supposed to be working on dumps from Windows 2003 these days - oddly, I
can't seem to find the list of supported Windows versions in the docs.)
I just ran into the same issue with Mandiant Memoryze, and bounced it
off Peter Siberman over there. He says this issue is extremely rare, but
they're fixing it in the next release. I have a system that appears to
have a second 'ghost' system process left over from an earlier boot. As
a result, when Memoryze attempts to process it, it's getting an
incorrect DTB address. The error I get from Volatility is "volatility:
error: Unable to locate valid DTB in image.", so I'm thinking it may
have the same problem. Should this be working, or am I just being a
dunce?
Thanks
John