Re: [Vol-users] Unable to get working profile - Vol 2.2, OS X 10.8.2

Greetings, The same error, or lack of output, with psscan. BTW - I am building up a Linux VM and will try this again on that VM. -David DawnTreader:Mem Analysis kovar$ vol.py -f *mem --profile=Win2003SP0x86 psscan Volatile Systems Volatility Framework 2.2 Offset(P) Name PID PPID PDB Time created Time exited ---------- ---------------- ------ ------ ---------- -------------------- -------------------- No suitable address space mapping found Tried to open image as: LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64: No base Address Space WindowsCrashDumpSpace32: No base Address Space AMD64PagedMemory: No base Address Space JKIA32PagedMemory: No base Address Space IA32PagedMemoryPae: Module disabled JKIA32PagedMemoryPae: No base Address Space IA32PagedMemory: Module disabled LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: No xpress signature found WindowsCrashDumpSpace64: Header signature invalid WindowsCrashDumpSpace32: Header signature invalid AMD64PagedMemory: Incompatible profile Win2003SP0x86 selected JKIA32PagedMemory: No valid DTB found IA32PagedMemoryPae: Module disabled JKIA32PagedMemoryPae: No valid DTB found IA32PagedMemory: Module disabled FileAddressSpace: Must be first Address Space On Oct 4, 2012, at 3:18 PM, Jamie Levy &lt;jamie.levy(a)gmail.com&gt; wrote: > have you tried any of the scanning plugins? like psscan, modscan or similar? > > > On Thu, Oct 4, 2012 at 4:16 PM, David Kovar &lt;dkovar(a)gmail.com&gt; wrote: >> Greetings, >> >> Two different samples, both fail for different reasons. These are supposedly raw memory samples collected from servers using FTK Imager. The one sample that generates a profile loads into Redline and produces all the normal info I'd expect. The other sample, the one that produces no results with imageinfo, may be bad. I've not loaded it into Redline yet. >> >> -David >> >> On Oct 4, 2012, at 3:14 PM, Jamie Levy &lt;jamie.levy(a)gmail.com&gt; wrote: >> >>> hrmmm strange... Am I missing something or are you asking about two >>> different samples? I see two different file names, but you're writing >>> this as if they are one. Are these raw memory samples? Do you have >>> any idea what the system might be? Have you tried any of the scanning >>> plugins? Which of these two samples did you run redline on and what >>> did you get back... any valid info? >>> >>> >>> >>> On Thu, Oct 4, 2012 at 2:58 PM, David Kovar &lt;dkovar(a)gmail.com&gt; wrote: >>>> Greetings, >>>> >>>> I am unable to get a viable profile for two different images. I built V2.2 on a MacBook Pro running 10.8.2. >>>> >>>> This one may be a bad image: >>>> >>>> <kdbgscan returns silently> >>>> DawnTreader:Mem Analysis kovar$ vol.py -f *dmp kdbgscan >>>> Volatile Systems Volatility Framework 2.2 >>>> >>>> DawnTreader:Mem Analysis kovar$ vol.py -f *dmp imageinfo >>>> Volatile Systems Volatility Framework 2.2 >>>> Determining profile based on KDBG search... >>>> >>>> Suggested Profile(s) : No suggestion (Instantiated with no profile) >>>> AS Layer1 : FileAddressSpace (/Users/kovar/Mem Analysis/redacted-27-09-2012-10-47-50.dmp) >>>> PAE type : No PAE >>>> >>>> ---------------- >>>> >>>> >>>> But this one loads in Mandiant Redline but Volatility will not produce any valid results. I've tried all three profiles with no success. >>>> >>>> DawnTreader:Mem Analysis kovar$ vol.py -f *mem imageinfo >>>> Volatile Systems Volatility Framework 2.2 >>>> Determining profile based on KDBG search... >>>> >>>> Suggested Profile(s) : Win2003SP0x86, Win2003SP1x86, Win2003SP2x86 >>>> AS Layer1 : JKIA32PagedMemoryPae (Kernel AS) >>>> AS Layer2 : FileAddressSpace (/Users/kovar/Mem Analysis/redacted_memdump.mem) >>>> PAE type : PAE >>>> DTB : 0x1595000L >>>> KDBG : 0x808943e0 >>>> Number of Processors : 2 >>>> Image Type (Service Pack) : 2 >>>> KPCR for CPU 0 : 0xffdff000 >>>> KPCR for CPU 1 : 0xf772f000 >>>> KUSER_SHARED_DATA : 0xffdf0000 >>>> Image date and time : 2012-10-01 19:31:06 UTC+0000 >>>> Image local date and time : 2012-10-01 13:31:06 -0600 >>>> >>>> DawnTreader:Mem Analysis kovar$ vol.py -f *mem kdbgscan >>>> Volatile Systems Volatility Framework 2.2 >>>> ************************************************** >>>> Instantiating KDBG using: /Users/kovar/Mem Analysis/redacted.mem Win2003SP0x86 (5.2.3789 32bit) >>>> Offset (P) : 0x8943e0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win2003SP1x86 >>>> Version64 : 0x8943b8 (Major: 15, Minor: 3790) >>>> PsActiveProcessHead : 0x808ad0c8 >>>> PsLoadedModuleList : 0x808a6ea8 >>>> KernelBase : 0x80800000 >>>> >>>> ************************************************** >>>> Instantiating KDBG using: /Users/kovar/Mem Analysis/redacted.mem Win2003SP0x86 (5.2.3789 32bit) >>>> Offset (P) : 0x8943e0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win2003SP2x86 >>>> Version64 : 0x8943b8 (Major: 15, Minor: 3790) >>>> PsActiveProcessHead : 0x808ad0c8 >>>> PsLoadedModuleList : 0x808a6ea8 >>>> KernelBase : 0x80800000 >>>> >>>> ************************************************** >>>> Instantiating KDBG using: /Users/kovar/Mem Analysis/redacted.mem Win2003SP0x86 (5.2.3789 32bit) >>>> Offset (P) : 0x8943e0 >>>> KDBG owner tag check : True >>>> Profile suggestion (KDBGHeader): Win2003SP0x86 >>>> Version64 : 0x8943b8 (Major: 15, Minor: 3790) >>>> PsActiveProcessHead : 0x808ad0c8 >>>> PsLoadedModuleList : 0x808a6ea8 >>>> KernelBase : 0x80800000 >>>> >>>> >>>> DawnTreader:Mem Analysis kovar$ vol.py -f *mem --profile=Win2003SP0x86 pslist >>>> Volatile Systems Volatility Framework 2.2 >>>> No suitable address space mapping found >>>> Tried to open image as: >>>> LimeAddressSpace: lime: need base >>>> WindowsHiberFileSpace32: No base Address Space >>>> WindowsCrashDumpSpace64: No base Address Space >>>> WindowsCrashDumpSpace32: No base Address Space >>>> AMD64PagedMemory: No base Address Space >>>> JKIA32PagedMemory: No base Address Space >>>> IA32PagedMemoryPae: Module disabled >>>> JKIA32PagedMemoryPae: No base Address Space >>>> IA32PagedMemory: Module disabled >>>> LimeAddressSpace: Invalid Lime header signature >>>> WindowsHiberFileSpace32: No xpress signature found >>>> WindowsCrashDumpSpace64: Header signature invalid >>>> WindowsCrashDumpSpace32: Header signature invalid >>>> AMD64PagedMemory: Incompatible profile Win2003SP0x86 selected >>>> JKIA32PagedMemory: No valid DTB found >>>> IA32PagedMemoryPae: Module disabled >>>> JKIA32PagedMemoryPae: No valid DTB found >>>> IA32PagedMemory: Module disabled >>>> FileAddressSpace: Must be first Address Space >>>> >>>> >>>> ----- >>>> >>>> Thanks for any help you might be able to offer. >>>> >>>> -David >>>> >>>> _______________________________________________ >>>> Vol-users mailing list >>>> Vol-users(a)volatilityfoundation.org >>>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >>> >>> >>> >>> -- >>> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92 >> > > > > -- > PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92