5:45 p.m.
Hello,
I'm getting some KDBG errors when examining a Windows Server 2008 R2
server memory image. I saw a similar post to this list back in August
2012 (http://lists.volatilityfoundation.org/pipermail/vol-users/2012-August/00056…)
Here's the output from a few plugins. It was captured by another
person and I don't know what tool or version he used.
Does it look like the memory image is corrupted?
Thanks,
Carlos
$ vol.py -f memdump.mem imageinfo
Volatility Foundation Volatility Framework 2.3.1
Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP0x64, Win7SP1x64,
Win2008R2SP0x64, Win2008R2SP1x64
AS Layer1 : AMD64PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (memdump.mem)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf80001def0a0
Number of Processors : 8
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff80001df0d00L
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 5, in <module>
pkg_resources.run_script('volatility==2.3.1', 'vol.py')
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in
run_script
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 183, in <module>
main()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 174, in main
command.execute()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py",
line 121, in execute
func(outfd, data)
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py",
line 35, in render_text
for k, v in data:
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py",
line 100, in calculate
yield ('KPCR for CPU {0}'.format(kpcr.ProcessorBlock.Number),
hex(kpcr.obj_offset))
TypeError: hex() argument can't be converted to hex
$
$
$ vol.py -f memdump.mem --profile=Win2008R2SP1x64 pslist
Volatility Foundation Volatility Framework 2.3.1
Offset(V) Name PID PPID Thds Hnds
Sess Wow64 Start Exit
------------------ -------------------- ------ ------ ------ --------
------ ------ ------------------------------
------------------------------
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 5, in <module>
pkg_resources.run_script('volatility==2.3.1', 'vol.py')
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in
run_script
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 183, in <module>
main()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 174, in main
command.execute()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py",
line 121, in execute
func(outfd, data)
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/taskmods.py",
line 140, in render_text
for task in data:
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py",
line 70, in pslist
for p in get_kdbg(addr_space).processes():
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py",
line 42, in processes
raise AttributeError("Could not list tasks, please verify your
--profile with kdbgscan")
AttributeError: Could not list tasks, please verify your --profile with kdbgscan
$
$
$ vol.py -f memdump.mem --profile=Win2008R2SP1x64 kdbgscan
Volatility Foundation Volatility Framework 2.3.1
**************************************************
Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit)
Offset (V) : 0xf80001def0a0
Offset (P) : 0x1def0a0
KDBG owner tag check : True
Profile suggestion (KDBGHeader): Win7SP1x64
Version64 : 0xf80001def068 (Major: 15, Minor: 7601)
Service Pack (CmNtCSDVersion) : 1
Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr.
PsActiveProcessHead : 0xfffff80001e253d0 (0 processes)
PsLoadedModuleList : 0xfffff80001e436d0 (0 modules)
KernelBase : 0xfffff80001c00000 (Matches MZ: True)
Major (OptionalHeader) : 6
Minor (OptionalHeader) : 1
KPCR : 0xfffff80001df0d00 (CPU 0)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
**************************************************
Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit)
Offset (V) : 0xf80001def0a0
Offset (P) : 0x1def0a0
KDBG owner tag check : True
Profile suggestion (KDBGHeader): Win2008R2SP1x64
Version64 : 0xf80001def068 (Major: 15, Minor: 7601)
Service Pack (CmNtCSDVersion) : 1
Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr.
PsActiveProcessHead : 0xfffff80001e253d0 (0 processes)
PsLoadedModuleList : 0xfffff80001e436d0 (0 modules)
KernelBase : 0xfffff80001c00000 (Matches MZ: True)
Major (OptionalHeader) : 6
Minor (OptionalHeader) : 1
KPCR : 0xfffff80001df0d00 (CPU 0)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
**************************************************
Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit)
Offset (V) : 0xf80001def0a0
Offset (P) : 0x1def0a0
KDBG owner tag check : True
Profile suggestion (KDBGHeader): Win2008R2SP0x64
Version64 : 0xf80001def068 (Major: 15, Minor: 7601)
Service Pack (CmNtCSDVersion) : 1
Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr.
PsActiveProcessHead : 0xfffff80001e253d0 (0 processes)
PsLoadedModuleList : 0xfffff80001e436d0 (0 modules)
KernelBase : 0xfffff80001c00000 (Matches MZ: True)
Major (OptionalHeader) : 6
Minor (OptionalHeader) : 1
KPCR : 0xfffff80001df0d00 (CPU 0)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
**************************************************
Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit)
Offset (V) : 0xf80001def0a0
Offset (P) : 0x1def0a0
KDBG owner tag check : True
Profile suggestion (KDBGHeader): Win7SP0x64
Version64 : 0xf80001def068 (Major: 15, Minor: 7601)
Service Pack (CmNtCSDVersion) : 1
Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr.
PsActiveProcessHead : 0xfffff80001e253d0 (0 processes)
PsLoadedModuleList : 0xfffff80001e436d0 (0 modules)
KernelBase : 0xfffff80001c00000 (Matches MZ: True)
Major (OptionalHeader) : 6
Minor (OptionalHeader) : 1
KPCR : 0xfffff80001df0d00 (CPU 0)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
KPCR : - (CPU -)
$
$
$ vol.py -f memdump.mem --profile=Win2008R2SP1x64 hivescan
Volatility Foundation Volatility Framework 2.3.1
Offset(P)
------------------
0x0000000000431010
0x00000000051a4010
0x000000000f1d7010
0x0000000013e15410
0x0000000015875410
0x000000005a517410
0x000000006e434410
0x000000007ddce410
0x00000000a143e410
0x00000000a7f8c410
0x00000000c3b83010
0x00000000cbb17410
0x00000000d0768410
$
$
$ vol.py -f memdump.mem --profile=Win2008R2SP1x64 svcscan
Volatility Foundation Volatility Framework 2.3.1
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 5, in <module>
pkg_resources.run_script('volatility==2.3.1', 'vol.py')
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script
File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in
run_script
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 183, in <module>
main()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py",
line 174, in main
command.execute()
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py",
line 121, in execute
func(outfd, data)
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py",
line 360, in render_text
for rec in data:
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py",
line 275, in calculate
for task in tasks.pslist(addr_space):
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py",
line 70, in pslist
for p in get_kdbg(addr_space).processes():
File
"/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py",
line 42, in processes
raise AttributeError("Could not list tasks, please verify your
--profile with kdbgscan")
AttributeError: Could not list tasks, please verify your --profile with kdbgscan