On this mailing list there was some discussion about hibernation files
with the first page (0x1000 bytes) zeroed out. The SVN version of hibinfo
converts one of these "inactive" hibernation files into a raw dd-type
image. But that seems to be all the support it currently has.
As an experiment, we changed is_hiberfil() to always return True and ran
the Volatility commands on an inactive hibernation file. They all appear
to run successfully.
So this leads to a few questions:
1) Was that just a fluke of the file we used that the Volatility commands
worked?
2) Are there any plans to identify/support hibernation files with the
first page zeroed out?
3) Can we assume that a file with the first 0x1000 bytes zeroed out is a
hibernation file?
4) If the answer to (2) is 'no' and the answer to (3) is 'yes', where can
we submit a patch?
Thanks
-matthew
I have a hiberfil.sys file from a windows xp sp3 machine and I am trying to
convert it to dd using the hibinfo script in volatility. I keep getting an
error half through the script as follows:
$ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\ Morgan/My\
Doc
uments/Hiberfil\ Test/hiberfil.sys -d /c/Documents\ and\ Settings/Mark\
Morgan/
My\ Documents/Hiberfil\ Test/hiber.dd
Signature:
SystemTime: Thu Jan 01 00:00:00 1970
Control registers flags
CR0: 80010031
CR0[PAGING]: 1
CR3: 0afc0080
CR4: 000006f1
CR4[PSE]: 1
CR4[PAE]: 1
Traceback (most recent call last):
File "volatility", line 219, in <module>
main()
File "volatility", line 212, in main
modules[argv[1]].execute(argv[1], argv[2:])
File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute
self.cmd_execute(module, args)
File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo
(major,minor,build) = hiberAS.get_version()
File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py", line
452, in
get_version
addr_space = IA32PagedMemoryPae(self,self.CR3)
NameError: global name 'IA32PagedMemoryPae' is not defined
I am wondering if it is because this is a sp3 box??? Any help would be
appreciated.
Mark Morgan
702-942-2556
Mark,
Let me know if you figure it out. I just tried the same command and received the following error;
======================================================================
C:\Python25>python \Volatility3\volatility hibinfo -f c:\hiberfil_test\hiberfil.sys -d c:\hibertest.dd
Signature:
SystemTime: Thu Jan 01 00:00:00 1970
Control registers flags
CR0: 00010000
CR0[PAGING]: 0
CR3: 7aed0001
CR4: 00010000
CR4[PSE]: 0
CR4[PAE]: 0
Traceback (most recent call last):
File "\Volatility3\volatility", line 219, in <module>
main()
File "\Volatility3\volatility", line 212, in main
modules[argv[1]].execute(argv[1], argv[2:])
File "C:\Volatility3\vmodules.py", line 62, in execute
self.cmd_execute(module, args)
File "C:\Volatility3\vmodules.py", line 1677, in hibinfo
(major,minor,build) = hiberAS.get_version()
File "C:\Volatility3\forensics\win32\hiber_addrspace.py", line 467, in get_version
['_KGDTENTRY','BaseLow'], NtTibAddr)
File "C:\Volatility3\forensics\object.py", line 206, in read_obj
return read_value(addr_space, current_type, vaddr + offset)
File "C:\Volatility3\forensics\object.py", line 71, in read_value
buf = addr_space.read(vaddr, type_size)
File "C:\Volatility3\forensics\x86.py", line 124, in read
paddr = self.vtop(vaddr)
File "C:\Volatility3\forensics\x86.py", line 109, in vtop
if self.entry_present(pgd):
File "C:\Volatility3\forensics\x86.py", line 72, in entry_present
if (entry & (0x00000001)) == 0x00000001:
TypeError: unsupported operand type(s) for &: 'NoneType' and 'int'
==================================================================
Detective Ritch Gilleland, EnCE, CCI
Sacramento Police Department
Office: 916-808-0564
RGilleland(a)pd.cityofsacramento.org
>>> Mark Morgan <mark.morgan47(a)gmail.com> 10/06/09 9:48 AM >>>
I have a hiberfil.sys file from a windows xp sp3 machine and I am trying to
convert it to dd using the hibinfo script in volatility. I keep getting an
error half through the script as follows:
$ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\ Morgan/My\
Doc
uments/Hiberfil\ Test/hiberfil.sys -d /c/Documents\ and\ Settings/Mark\
Morgan/
My\ Documents/Hiberfil\ Test/hiber.dd
Signature:
SystemTime: Thu Jan 01 00:00:00 1970
Control registers flags
CR0: 80010031
CR0[PAGING]: 1
CR3: 0afc0080
CR4: 000006f1
CR4[PSE]: 1
CR4[PAE]: 1
Traceback (most recent call last):
File "volatility", line 219, in <module>
main()
File "volatility", line 212, in main
modules[argv[1]].execute(argv[1], argv[2:])
File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute
self.cmd_execute(module, args)
File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo
(major,minor,build) = hiberAS.get_version()
File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py", line
452, in
get_version
addr_space = IA32PagedMemoryPae(self,self.CR3)
NameError: global name 'IA32PagedMemoryPae' is not defined
I am wondering if it is because this is a sp3 box??? Any help would be
appreciated.
Mark Morgan
702-942-2556
I'm sorry, that by far exceeds my knowledge about the hibernate stuff. I
don't even have a suitable file for testing on stock. Could someone else
please look into this?
Thanks,
Andreas
Mark Morgan:
> Andreas,
>
> Thanks for the quick reply. I changed the line as requested and here
> is the error I get:
>
> $ python volatility hibinfo -f /c/Documents\ and\ Settings/Mark\
> Morgan/My\ Doc
> uments/sandman/hiberfil.sys -d hiber.dd
> Signature:
> SystemTime: Thu Jan 01 00:00:00 1970
>
> Control registers flags
> CR0: 80010031
> CR0[PAGING]: 1
> CR3: 0afc0080
> CR4: 000006f1
> CR4[PSE]: 1
> CR4[PAE]: 1
> Traceback (most recent call last):
> File "volatility", line 219, in <module>
> main()
> File "volatility", line 212, in main
> modules[argv[1]].execute(argv[1], argv[2:])
> File "c:\Volatility-1.3_Beta\vmodules.py", line 62, in execute
> self.cmd_execute(module, args)
> File "c:\Volatility-1.3_Beta\vmodules.py", line 1677, in hibinfo
> (major,minor,build) = hiberAS.get_version()
> File "c:\Volatility-1.3_Beta\forensics\win32\hiber_addrspace.py",
> line 467, in
> get_version
> ['_KGDTENTRY','BaseLow'], NtTibAddr)
> File "c:\Volatility-1.3_Beta\forensics\object.py", line 246, in
> read_obj
> return read_value(addr_space, current_type, vaddr + offset)
> File "c:\Volatility-1.3_Beta\forensics\object.py", line 71, in
> read_value
> buf = addr_space.read(vaddr, type_size)
> File "c:\Volatility-1.3_Beta\forensics\x86.py", line 313, in read
> paddr = self.vtop(vaddr)
> File "c:\Volatility-1.3_Beta\forensics\x86.py", line 294, in vtop
> if not self.entry_present(pdpe):
> File "c:\Volatility-1.3_Beta\forensics\x86.py", line 239, in
> entry_present
> if (entry & (0x00000001)) == 0x00000001:
> TypeError: unsupported operand type(s) for &: 'NoneType' and 'int'
>
> And here is the portion of the hiber_addrspace.py that I changed:
>
> from forensics.addrspace import FileAddressSpace
> import forensics.x86
> from forensics.object import *
> from forensics.win32.xpress import xpress_decode
> from thirdparty.progressbar import *
> from forensics.win32.datetime import *
> from vtypes import xpsp2types as types
> from forensics.x86 import IA32PagedMemory,IA32PagedMemoryPae
>
>
> Mark Morgan
>
> On Tue, Oct 6, 2009 at 11:06 AM, Andreas Schuster
> <a.schuster(a)yendor.net> wrote:
> Mark,
>
> Thank you for your bug report.
>
> > CR4[PAE]: 1
>
> > File "c:\Volatility-1.3_Beta\forensics\win32
> \hiber_addrspace.py",
> > line 452, in
> > get_version
> > addr_space = IA32PagedMemoryPae(self,self.CR3)
> > NameError: global name 'IA32PagedMemoryPae' is not defined
>
> > I am wondering if it is because this is a sp3 box??? Any
> help would
> > be appreciated.
>
>
> No, it happens because the system was in PAE mode (CR4[PAE]:
> 1), but the
> programmer forgot to import the PAE address space.
>
> Please edit forensics/win32/hiber_addrspace.py, line 43, to
> become:
> from forensics.x86 import IA32PagedMemory, IA32PagedMemoryPae
>
> Please let us know if this fixes the problem.
>
> Thanks!
> Andreas
>
>
