Volatility errors after update?
by Andre' M. DiMino
I just did an svn update to version 1327 and I'm now noticing the
following errors upon execution of any volatility command. For example:
~/tools/Volatility/vol.py -f XP_SP3.vmem imageinfo
Volatile Systems Volatility Framework 2.1_alpha
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated
with WinXPSP2x86)
:
snip
:
~/tools/Volatility/vol.py -f XP_SP3.vmem --profile=WinXPSP3x86 connscan
Volatile Systems Volatility Framework 2.1_alpha
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
Offset(P) Local Address Remote Address Pid
---------- ------------------------- ------------------------- ------
0x0219fa40 0.0.0.0:19272 0.0.0.0:55542 2147487916
~/tools/Volatility/vol.py -f XP_SP3.vmem --profile=WinXPSP3x86 modules
Volatile Systems Volatility Framework 2.1_alpha
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp1_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp1_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import
volatility.plugins.overlays.windows.win2k8_sp2_x86_vtypes
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
*** Failed to import volatility.plugins.overlays.windows.win2k8_sp2_x86
(AttributeError: 'module' object has no attribute 'ntkrnlmp_types')
Offset(V) File Base
Size Name
0x823fc3a0 \WINDOWS\system32\ntkrnlpa.exe
0x00804d7000 0x1f8580 ntoskrnl.exe
0x823fc338 \WINDOWS\system32\hal.dll
0x00806d0000 0x020300 hal.dll
:
snip
:
Everything seems to complete OK so far, but I'm wondering what might
have caused these new error messages.
Thanks!
Andre'
--
Andre' M. DiMino
DeepEnd REsearch
http://deependresearch.org
http://sempersecurus.org
"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)
12 years, 9 months
- 3
- 3
Volatility-Linux TypeError
by Patrick Burkard
Hello,
in the last view weeks i've tried to analyze Linux memorydumps with the
volatility-linux Version (Revision 1313 from svn).
My goal is to show that it is possible to discover hidden processes,
kernelmodules etc. (for example from a rootkit) from a memory dump. By
comparing the output from the memorydump analysis with the native
execution of the system commands.
I created a profile for the current stable Debian version.
Trying to use this profile leads to the following TypeError:
python volatility.py --profile=LinuxDebian26325 -f ~/Desktop/LF32.ram
linux_task_list_ps Volatile Systems Volatility Framework 1.4_rc1
Name Pid Uid
Traceback (most recent call last):
File "volatility.py", line 129, in <module>
main()
File "volatility.py", line 120, in main
command.execute()
File
"/home/dark-eye/Sources/volatility_linux/volatility/commands.py", line
101, in execute func(outfd, data) File
"/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_task_list_ps.py",
line 59, in render_text for task in data: File
"/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_task_list_ps.py",
line 50, in calculate for task in
linux_common.walk_list_head("task_struct", "tasks", init_task.tasks,
self.addr_space): File
"/home/dark-eye/Sources/volatility_linux/volatility/plugins/linux_common.py",
line 110, in walk_list_head yield obj.Object(struct_name, offset =
list_ptr - offset, vm = addr_space) TypeError: unsupported operand
type(s) for -: 'instancemethod' and 'int'
I would really appreciate to debug or help to debug this issue. Sadly I
can't find a way to evaluate the correctness of the kernel-profile. Is
this a known problem from volatility-linux or could it be the result of
a failure i've made while creating the debian profile?
Thanks for every hint!
Greetings
Patrick
12 years, 9 months
- 5
- 11