Re: [Vol-users] Traceback errors when using yara
2 Feb
2012
2 Feb
'12
5:31 p.m.
Hey Andre'
If you're using malware.py from
http://code.google.com/p/malwarecookbook/source/browse/trunk/malware.py,
its only going to work with one of the 2.0 stable downloads from
http://code.google.com/p/volatility/downloads/list. It sounds like
you're using malware.py or malware2.1_alpha.py from the above link but
with the Volatility 2.1 alpha branch from svn trunk. You'd think
malware2.1_alpha.py is compatible with the 2.1 alpha branch of
Volatility but current its just my template for where the malware
plugins will go once 2.1 is released and stable.
So in short, if you want to use malware plugins, use malware.py with
the 2.0 stable release. If you want to use the 2.1 alpha trunk with
x64 support, there are currently no malware plugins. But by the time
2.1 is released, there will be.
Sorry for the confusion!
MHL
On Thu, Feb 2, 2012 at 5:19 PM, Andre' M. DiMino
<adimino(a)sempersecurus.org> wrote:
Greetings,
I'm seeing the following errors when attempting to run volatility with
'malfind' and referencing yara. This used to work fine on yara 1.4, but
now fails on 1.6. I'm wondering what might have happened and how to
resolve it.
~/vol.py -f purple.vmem --profile=WinXPSP3x86 malfind -D
/home/apollo/workspace/dump_dir/ --yara-rules="http://" -p 1004
Volatile Systems Volatility Framework 2.1_alpha
Name Pid Start End Tag Hits Protect
Traceback (most recent call last):
File "/home/apollo/vol.py", line 135, in <module>
main()
File "/home/apollo/vol.py", line 126, in main
command.execute()
File "/home/sportivo/tools/Volatility/volatility/commands.py", line
101, in execute
func(outfd, data)
File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py",
line 1042, in render_text
for (name,pid,start,end,tag,prx,fname,hits,chunk) in data:
File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py",
line 992, in calculate
for ps_ad, start, end, tag, prx, data in self.get_vads(proc):
File "/home/sportivo/tools/Volatility/volatility/plugins/malware.py",
line 923, in get_vads
yield (ps_ad, start, end, vad.Tag, vad.Flags.Protection >> 24, data)
File "/home/sportivo/tools/Volatility/volatility/obj.py", line 777, in
__getattr__
return self.m(attr)
File "/home/sportivo/tools/Volatility/volatility/obj.py", line 762, in m
raise AttributeError("Struct {0} has no member
{1}".format(self.obj_name, attr))
AttributeError: Struct VadRoot has no member Flags
Any thoughts or ideas are welcome. Thanks!
Andre'
--
Andre' M. DiMino
DeepEnd REsearch
http://deependresearch.org
http://sempersecurus.org
"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users