Re: [Vol-users] Windows Server 2008

Trying imageinfo with a debug flag ends like this: DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0xb3752d0> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG : volatility.plugins.addrspaces.vmware: Read region count from file: 2 DEBUG : volatility.plugins.addrspaces.vmware: RegionCount: 2 DEBUG : volatility.plugins.addrspaces.vmware: Virtual Address: 0, Physical Address: 0, Size: C0000000 Virtual Address: 100000000, Physical Address: C0000000, Size: 40000000 DEBUG : volatility.plugins.addrspaces.vmware: dtb: 187000 DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.vmware.VMWareSnapshotFile object at 0xb3754d0> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> --Return-- /usr/local/src/volatility-read-only-may-01/volatility/debug.py(88)b()->None -> pdb.set_trace() (Pdb) Cheers, Jesse On Fri, Jul 6, 2012 at 10:52 AM, Jesse Bowling &lt;jessebowling(a)gmail.com&gt;wrote: > Ah, actually I see that that is no better... :( > > First 1024: > > # dd if=myimage.vmss bs=1 count=1024 | xxd > 1024+0 records in > 1024+0 records out > 1024 bytes (1.0 kB) copied, 0.00110567 s, 926 kB/s > 0000000: d2be d2be 0800 0000 5b00 0000 4368 6563 ........[...Chec > 0000010: 6b70 6f69 6e74 0000 0000 0000 0000 0000 kpoint.......... > 0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000040: 0000 0000 0000 0000 0000 0000 7c1c 0000 ............|... > 0000050: 0000 0000 ab03 0000 0000 0000 6370 7500 ............cpu. > 0000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000090: 0000 0000 0000 0000 0000 0000 2720 0000 ............' .. > 00000a0: 0000 0000 cce1 0300 0000 0000 4275 734d ............BusM > 00000b0: 656d 5361 6d70 6c65 0000 0000 0000 0000 emSample........ > 00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00000e0: 0000 0000 0000 0000 0000 0000 f301 0400 ................ > 00000f0: 0000 0000 4f00 0000 0000 0000 4275 734d ....O.......BusM > 0000100: 656d 5365 7276 6963 6573 0000 0000 0000 emServices...... > 0000110: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000120: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000130: 0000 0000 0000 0000 0000 0000 4202 0400 ............B... > 0000140: 0000 0000 1200 0000 0000 0000 5555 4944 ............UUID > 0000150: 564d 5800 0000 0000 0000 0000 0000 0000 VMX............. > 0000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000180: 0000 0000 0000 0000 0000 0000 5402 0400 ............T... > 0000190: 0000 0000 2e00 0000 0000 0000 5374 6174 ............Stat > 00001a0: 654c 6f67 6765 7200 0000 0000 0000 0000 eLogger......... > 00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00001d0: 0000 0000 0000 0000 0000 0000 8202 0400 ................ > 00001e0: 0000 0000 0200 0000 0000 0000 6d65 6d6f ............memo > 00001f0: 7279 0000 0000 0000 0000 0000 0000 0000 ry.............. > 0000200: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000220: 0000 0000 0000 0000 0000 0000 8402 0400 ................ > 0000230: 0000 0000 7efd 0000 0100 0000 4d53 7461 ....~.......MSta > 0000240: 7473 0000 0000 0000 0000 0000 0000 0000 ts.............. > 0000250: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000260: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000270: 0000 0000 0000 0000 0000 0000 0200 0500 ................ > 0000280: 0100 0000 3619 0000 0000 0000 536e 6170 ....6.......Snap > 0000290: 7368 6f74 0000 0000 0000 0000 0000 0000 shot............ > 00002a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00002b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00002c0: 0000 0000 0000 0000 0000 0000 3819 0500 ............8... > 00002d0: 0100 0000 a971 0000 0000 0000 7069 6300 .....q......pic. > 00002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00002f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000300: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000310: 0000 0000 0000 0000 0000 0000 e18a 0500 ................ > 0000320: 0100 0000 0e07 0000 0000 0000 5469 6d65 ............Time > 0000330: 5472 6163 6b65 7200 0000 0000 0000 0000 Tracker......... > 0000340: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000350: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 0000360: 0000 0000 0000 0000 0000 0000 ef91 0500 ................ > 0000370: 0100 0000 9900 0000 0000 0000 466c 6f70 ............Flop > 0000380: 7079 0000 0000 0000 0000 0000 0000 0000 py.............. > 0000390: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00003a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00003b0: 0000 0000 0000 0000 0000 0000 8892 0500 ................ > 00003c0: 0100 0000 8c91 0000 0000 0000 4775 6573 ............Gues > 00003d0: 744d 7367 0000 0000 0000 0000 0000 0000 tMsg............ > 00003e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > 00003f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ > > > > On Fri, Jul 6, 2012 at 10:50 AM, Jesse Bowling &lt;jessebowling(a)gmail.com&gt;wrote: > >> Seems better: >> >> root@Forensic-1:/case2/4132012/biweb/mem# >> /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss psscan >> >> Volatile Systems Volatility Framework 2.1_alpha >> Offset(P) Name PID PPID PDB Time >> created Time exited >> ---------- ---------------- ------ ------ ---------- >> ------------------------ ------------------------ >> No suitable address space mapping found >> Tried to open image as: >> ... >> >> VMWareSnapshotFile: ('Header signature invalid', 4026597203) >> ... >> >> >> >> >> >> On Fri, Jul 6, 2012 at 10:29 AM, Jamie Levy &lt;jamie.levy(a)gmail.com&gt;wrote: >> >>> Try to place them in volatility/plugins/addrspaces/ instead and then >>> do a `make clean` before running >>> >>> >>> >>> On Fri, Jul 6, 2012 at 10:03 AM, Jesse Bowling &lt;jessebowling(a)gmail.com&gt; >>> wrote: >>> > Disclaimer: >>>>>> > So I took Nir's files, and dropped them into my plugins folder...I >>> did not >>> > see any new plugins using vol.py -h, and when I tried to do an >>> imageinfo I >>> > got: >>>>>> > /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss >>> imageinfo >>>>>> > Volatile Systems Volatility Framework 2.1_alpha >>> > Determining profile based on KDBG search... >>>>>> > Traceback (most recent call last): >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 173, in >>> > <module> >>> > main() >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 164, in >>> > main >>> > command.execute() >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/commands.py", >>> > line 101, in execute >>> > func(outfd, data) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/imageinfo.py", >>> > line 34, in render_text >>> > for k, v in data: >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/imageinfo.py", >>> > line 44, in calculate >>> > suglist = [ s for s, _, _ in kdbg.KDBGScan.calculate(self)] >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/kdbgscan.py", >>> > line 119, in calculate >>> > for offset in scanner.scan(aspace): >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/kdbgscan.py", >>> > line 83, in scan >>> > for offset in scan.BaseScanner.scan(self, address_space, offset, >>> > maxlen): >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/scan.py", line >>> > 136, in scan >>> > skip = max(skip, s.skip(data, i)) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py", >>> > line 49, in skip >>> > nextval = data.index(self.tag, offset + 1) >>> > AttributeError: 'NoneType' object has no attribute 'index' >>>>>> > So: >>>>>> > # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss >>> psscan >>>>>> > Volatile Systems Volatility Framework 2.1_alpha >>> > Offset(P) Name PID PPID PDB Time created >>> > Time exited >>> > ---------- ---------------- ------ ------ ---------- >>> > ------------------------ ------------------------ >>> > No suitable address space mapping found >>> > Tried to open image as: >>> > WindowsHiberFileSpace32: No base Address Space >>> > VMWareSnapshotFile: No base Address Space >>> > WindowsCrashDumpSpace32: No base Address Space >>> > AMD64PagedMemory: No base Address Space >>> > JKIA32PagedMemory: No base Address Space >>> > JKIA32PagedMemoryPae: No base Address Space >>> > IA32PagedMemoryPae: Module disabled >>> > IA32PagedMemory: Module disabled >>> > WindowsHiberFileSpace32: No xpress signature found >>> > WindowsHiberFileSpace32: No xpress signature found >>> > VMWareSnapshotFile: ('Header signature invalid', 4026597203) >>> > WindowsCrashDumpSpace32: Header signature invalid >>> > AMD64PagedMemory: Incompatible profile WinXPSP2x86 selected >>> > JKIA32PagedMemory: Failed valid Address Space check >>> > JKIA32PagedMemoryPae: Failed valid Address Space check >>> > IA32PagedMemoryPae: Module disabled >>> > IA32PagedMemory: Module disabled >>> > FileAddressSpace: Must be first Address Space >>>>>> > At least it doesn't crash. So now: >>>>>> > # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss >>> > --profile=Win2008R2SP1x64 psscan >>>>>> > Volatile Systems Volatility Framework 2.1_alpha >>> > Offset(P) Name PID PPID PDB Time created >>> > Time exited >>> > ---------- ---------------- ------ ------ ---------- >>> > ------------------------ ------------------------ >>> > Traceback (most recent call last): >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 173, in >>> > <module> >>> > main() >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 164, in >>> > main >>> > command.execute() >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/commands.py", >>> > line 101, in execute >>> > func(outfd, data) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py", >>> > line 415, in render_text >>> > for eprocess in data: >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py", >>> > line 405, in calculate >>> > for offset in PoolScanProcess().scan(address_space): >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/scan.py", line >>> > 218, in scan >>> > for i in BaseScanner.scan(self, address_space, offset, maxlen): >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/scan.py", line >>> > 136, in scan >>> > skip = max(skip, s.skip(data, i)) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py", >>> > line 49, in skip >>> > nextval = data.index(self.tag, offset + 1) >>> > AttributeError: 'NoneType' object has no attribute 'index' >>>>>> > # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss >>> > --profile=Win2008R2SP1x64 --dtb=0x187000 psscan >>>>>> > Volatile Systems Volatility Framework 2.1_alpha >>> > Offset(P) Name PID PPID PDB Time created >>> > Time exited >>> > ---------- ---------------- ------ ------ ---------- >>> > ------------------------ ------------------------ >>> > Traceback (most recent call last): >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 173, in >>> > <module> >>> > main() >>> > File "/usr/local/src/volatility-read-only-may-01/vol.py", line >>> 164, in >>> > main >>> > command.execute() >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/commands.py", >>> > line 101, in execute >>> > func(outfd, data) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py", >>> > line 415, in render_text >>> > for eprocess in data: >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py", >>> > line 405, in calculate >>> > for offset in PoolScanProcess().scan(address_space): >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/scan.py", line >>> > 218, in scan >>> > for i in BaseScanner.scan(self, address_space, offset, maxlen): >>> > File >>> "/usr/local/src/volatility-read-only-may-01/volatility/scan.py", line >>> > 136, in scan >>> > skip = max(skip, s.skip(data, i)) >>> > File >>>>>> "/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py", >>> > line 49, in skip >>> > nextval = data.index(self.tag, offset + 1) >>> > AttributeError: 'NoneType' object has no attribute 'index' >>>>>> > I have limited testing time the next couple weeks, so will look to >>> see if I >>> > can share this with someone like SA in the meantime... >>>>>> > Cheers, >>>>>> > Jesse >>>>>>>>> > On Fri, Jul 6, 2012 at 7:21 AM, nir izraeli &lt;nirizr(a)gmail.com&gt; >>> wrote: >>> >> >>> >> I assume you need it for something other than test my patch, >>> >> I can send parts of the vmss of the machine I already noticed more >>> than >>> >> one region. >>> >> could you use that to gather the info you need? >>> >> >>> >> btw, I'm also using vmware converter standalone pretty often, it >>> might >>> >> also be related >>> >> >>> >> >>> >> On Fri, Jul 6, 2012 at 5:31 AM, AAron Walters &lt;awalters(a)4tphi.net&gt; >>> wrote: >>> >>> >>> >>> >>> >>> Nir, >>> >>> >>> >>> >>> >>>> AAron - actually it was quite rare, but the first vmss I used to >>> test >>> >>>> the patch >>> >>>> had two or three, which made my patch break when i first tested >>> it on >>> >>>> other >>> >>>> VMs. >>> >>>> I could try to pinpoint it, but i guess it would be easier for me >>> to >>> >>>> reverse >>> >>>> the vmware code than try it manually :) >>> >>>> A thing to note is that that vmss also had two virtual CPUs, >>> which might >>> >>>> have >>> >>>> caused having more than one region. it also had ~4G of RAM. most >>> of the >>> >>>> other >>> >>>> VMs i used only had about 512M. >>> >>>> did you try to run it on other vmss files that resemble the one i >>> >>>> described? >>> >>> >>> >>> >>> >>> Interesting. I have never seen a vmss with multiple regions. If >>> you >>> >>> happen to come across one again, please let me know. I'd be >>> interested in >>> >>> what conditions or what product leads to more than one region. >>> >>> >>> >>> Thanks, >>> >>> >>> >>> AW >>> >> >>> >> >>>>>>>>>>>> > -- >>> > Jesse Bowling >>>>>>>>>>>> > _______________________________________________ >>> > Vol-users mailing list >>> > Vol-users(a)volatilityfoundation.org >>> > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >>>>>> >>> >>> >>> -- >>> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 >>> >> >> >> >> -- >> Jesse Bowling >> >> >> > > > -- > Jesse Bowling > > > -- Jesse Bowling