Re: [Vol-users] Windows Server 2008

Hi AAron, On Mon, Jul 2, 2012 at 1:02 PM, AAron Walters &lt;awalters(a)4tphi.net&gt; wrote: x86_64 This was a VMWare 4.1 virtual machine that was paused, and the vmss file copied out. Much later I head referenced that pausing the virtual machine actually causes a lot of information to be removed from memory due to the way VMWare prepares the OS to pause... :( (Can you or anyone speak to the truth-iness of this?) This line produces output: vol.py --profile=Win2008R2SP1x64 --dtb=0x187000 -f myimage.vmss psscan While others like pslist or imageinfo fail to produce output at all, and appear to hang (or at least, run longer than my patience, several hours at one point): # vol.py --profile=Win2008R2SP1x64 --dtb=0x187000 --verbose -d -f myimage.vmss pslist Volatile Systems Volatility Framework 2.1_alpha DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from MalwareSvcRecent DEBUG : volatility.obj : Applying modification from MalwareSvcRecentVTypesx64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0x37dfa10> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x3d86710> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.JKIA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemoryPae'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.legacyintel.IA32PagedMemory'> DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> Offset(V) Name PID PPID Thds Hnds Time ---------- -------------------- ------ ------ ------ ------ ------------------- <here I hit Ctrl-C> I'm happy to try any advice to get this working; although this is an old case, I'm sure I'll have more like this and would love to be able to properly collect and analyze 2008R2 from a VMWare instance...All advice welcome. :) Cheers, Jesse PS. I still owe you a call ;(. ...Anytime. Once this damnable lack of power passes, I'd even offer to exchange the call for beer-while-I-pick-your-brain. :) -- Jesse Bowling