Re: [Vol-users] Windows Server 2008

Hi,I'm the writer of the VMSS file format. I joined the mailing list since this conversation was posted there, hopefully I could shad some light over the issue. as far as i can tell installing the VMSS address space plugin should solve this issue. the VMSS format is a hybrid of text and binary encoding, but most of the memory indeed remains intact (there's an option to compress/encrypt but i have never seen it used) the format holds memory regions raw, so it's pretty easy to extract them directly from the file. from the tests I've made(a bulk of vmss files from different ESXi/workstation installations), if there's no *.vmem attached to the image the memory is probably embedded inside the VMSS/VMSN files and should be available using my code. if this isn't the case I'd love to get the VMSS file (if possible) and check what's wrong with it. cheers,  - Nir. On Wed, Jul 4, 2012 at 5:40 PM, Michael Hale Ligh <michael.hale(a)gmail.com> wrote: Hey Jesse, Coincidentally there was a code submission today that adds a vmss/vmsn address space layer to volatility. If you have cycles to test with your vmss, perhaps you could post some feedback on the issue? https://code.google.com/p/volatility/issues/detail?id=288 If nothing else, this probably confirms that vmss are a slightly different format than raw/vmem, thus your experiences with them in the past is likely not specific to Server2008, its just a format thing like AW suspected. But just to corroborate, can I ask a few questions: * Have you tried analyzing a vmss from profiles other than Server2008? If so, did any of the non-scanning plugins work? * Have you tried acquiring memory from Server2008 using a method other than suspending and copying out the vmss? Thanks! MHL On Mon, Jul 2, 2012 at 1:44 PM, Jesse Bowling <jessebowling(a)gmail.com> wrote: <awalters(a)4tphi.net> wrote: vmss file actually way VMWare truth-iness psscan all, and hours at 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> Win7x64Tcpip WindowsVTypes HiberWin7SP01x64 > Win64SyscallVTypes WindowsOverlay EThreadCreateTime MalwarePspCid UserAssistVTypes VistaWin7KPCR Win7x64Hiber > WinPEObjectClasses WinPEVTypes > WindowsObjectClasses > CmdHistoryObjectClasses > CmdHistoryVTypesWin7x64 ExFastRefx64 MalwareDrivers > MalwareObjectClasesXP MalwareSvcRecent > MalwareSvcRecentVTypesx64 > UserAssistWin7VTypes Win2003MMVad Win7KDBG Win7ObjectClasses WinPEx64VTypes Windows64Overlay VistaMMVAD Win7x64DTB at 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> 0x3d86710> 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> generally a an old to advice offer to 2008R2 image, Some would (I interested not Volatility 2008? _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users