Hi Sean,
It seems very strange that you’d get a different number of processes with each run.
Coupled with the IOError and the path being /mnt/hgfs (VMware host to guest), I would try
to first rule out something weird with VMware Tools data transfer. Can you copy the memory
dump into your virtual machine and run Volatility against the local file?
MHL
--------------------------------------------------
Michael Ligh (@iMHLv2)
GPG:
http://mnin.org/gpg.pubkey.txt
Blog:
http://volatility-labs.blogspot.com
On Sep 25, 2014, at 8:57 AM, Sean McLinden <mclinden(a)informed.net> wrote:
I just build a VM with Debian (I needed to install other packages) and when I run this on
a memory image I get the following (after about 10 minutes). The pslist.txt file is
partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is
believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py",
line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users