Hey Nir, <br><br><div class="gmail_quote">On Fri, Jul 6, 2012 at 7:22 PM, nir izraeli <span dir="ltr">&lt;<a href="mailto:nirizr@gmail.com" target="_blank">nirizr@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Michael, if you&#39;ll load the vmss AS with the -d flag it&#39;ll print the regions specified in the vmss file.</div></blockquote><div><br></div><div>That was done, you should have seen it in my last email. It was:</div>
<div><br></div><div><div>$ python vol.py -d -f Win2008SP1x64-9de64630.vmss --profile=Win2008SP1x64 pslist</div><div>Volatile Systems Volatility Framework 2.1_alpha</div><div>[snip]</div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div>
<div><div>DEBUG   : volatility.plugins.addrspaces.vmware: Read region count from file: 2</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: RegionCount: 2</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: Virtual Address:          0, Physical Address:        0, Size: C0000000</div>
<div>Virtual Address:  100000000, Physical Address: C0000000, Size: 40000000</div></div><div>DEBUG   : volatility.plugins.addrspaces.vmware: dtb: 124000</div></div><div>[snip]</div><div><br></div><div>So I&#39;ve just completed a test by reducing the RAM size of my Win2008SP1x64 system from 4 GB down to 3 GB. This reduced the number of regions to 1 and allows plugins like pslist to work on the vmss with your AS:</div>
<div><br></div><div><div>$ python vol.py -d -f Win2008SP1x64-9de64630\ \(1\).vmss --profile=Win2008SP1x64 pslist</div><div>Volatile Systems Volatility Framework 2.1_alpha</div></div><div>[snip]</div><div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div>
<div>DEBUG   : volatility.plugins.addrspaces.vmware: RegionCount: 1</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: Virtual Address:          0, Physical Address:        0, Size: C0000000</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: dtb: a77d3000</div>
</div><div>[snip]</div><div><div>Offset(V)          Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                Exit                </div><div>------------------ -------------------- ------ ------ ------ -------- ------ ------ -------------------- --------------------</div>
<div>0xfffffa8002492950 System                    4      0     97      440 ------      0 2012-07-07 01:01:26                      </div><div>0xfffffa8002f80320 smss.exe                400      4      4       28 ------      0 2012-07-07 01:01:26                      </div>
<div>0xfffffa8002ffb8b0 csrss.exe               468    456     10      353      0      0 2012-07-07 01:01:30                      </div><div>0xfffffa8003033900 csrss.exe               512    504      7       77      1      0 2012-07-07 01:01:32                      </div>
<div>0xfffffa800303bc10 wininit.exe             520    456      3      103      0      0 2012-07-07 01:01:33                      </div><div>0xfffffa8002d8f310 winlogon.exe            548    504      3      101      1      0 2012-07-07 01:01:33</div>
</div><div>[snip]</div><div><br></div><div>Here is the first 0x10000 from my Win2008SP1x64 with 4 GB and Win2008SP1x64 with 3 GB. At this point I still can&#39;t say if its related to your patch and how its mapping the regions. By the way I was also able to test successfully a Win7 SP1 x64 with 2 GB RAM using your AS, so its not necessarily a memory model issue (maybe memory model in addition to RAM size &gt;= 4 GB but at least we know its not isolated to all x64). </div>
<div><br></div><div>Narrowing down the cases, I&#39;m sure we&#39;ll figure it out soon...</div><div><br></div><div>MHL</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>it might help you to check if the address really exist in the file. I would bet there&#39;s more than a single region so the file size is not indicative.</div>

<div>i&#39;ll try running a few checks on my part to make sure it is unrelated to my patch.</div><div><br></div><div>if you wish to investigate it further you could quite easily use the VMSSParser directly, but you might rather leave it to me :)</div>


<div><br></div><div>I&#39;ll also hurry with the zread function so you could make more tests.</div><div>hopefully I&#39;ll write it tomorrow, since it&#39;s 2AM over here and I&#39;ve already made some promises I should keep for today :)</div>


<div><br></div><div>help with the object system will be much appreciated.</div><div><br></div><div>btw,</div><div>a list of the features/methods required of an AS could have been useful, but i don&#39;t how many AS commits you receive so it might be unnecessary.</div>


<div>I won&#39;t mind writing one if reviewed properly. an &quot;example&quot; AS could also do the trick</div><div><br></div><div>Cheers,</div><div> - Nir</div><div><div class="h5"><div><br><div class="gmail_quote">On Sat, Jul 7, 2012 at 2:02 AM, Michael Hale Ligh <span dir="ltr">&lt;<a href="mailto:michael.hale@gmail.com" target="_blank">michael.hale@gmail.com</a>&gt;</span> wrote:<br>


<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Nir, <div><br></div><div>We can definitely help out with integrating your code with the object system. I was just in the process of testing it for the first time this afternoon. </div>


<div><br></div><div>Here are a few details (I&#39;ll copy them to the issue tracker in a sec). Basically I started with an ESX 4.1.0 and grabbed the following: </div>
<div><br></div><div>* vmsn from xpsp2 x86 256 MB</div><div>* vmsn from win7 sp1 x86 512 MB</div><div>* vmss from server 2008 sp1 x64 4 GB </div><div><br></div><div>Your AS with the latest 2.1 alpha (so about r1983) worked fine for the xp vmsn. (by fine I mean pslist worked, but other plugins may not work properly due to what scudette said about zread)</div>



<div><br></div><div><div>=================================================</div><div>VMSN - XPSP3 x86 @ 256 MB RAM</div><div><br></div><div>$ python vol.py -d -f Andrew-Snapshot6.vmsn pslist</div><div><div>Volatile Systems Volatility Framework 2.1_alpha</div>



</div><div>[snip]</div><div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div></div><div>DEBUG   : volatility.plugins.addrspaces.vmware: RegionCount: 1</div>


<div>
DEBUG   : volatility.plugins.addrspaces.vmware: Virtual Address:          0, Physical Address:        0, Size: 10000000</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: dtb: 39000</div><div>DEBUG   : volatility.utils    : Succeeded instantiating &lt;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile object at 0x10363a890&gt;</div>



<div>Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                Exit                </div><div><div>---------- -------------------- ------ ------ ------ -------- ------ ------ -------------------- --------------------</div>



</div><div>0x81bcc830 System                    4      0     52      477 ------      0                                          </div><div>0x8194a020 smss.exe                364      4      3       21 ------      0 2012-01-25 20:44:20                      </div>



<div>0x81954020 csrss.exe               616    364     10      345      0      0 2012-01-25 20:44:20                      </div><div>0x81951128 winlogon.exe            640    364     16      495      0      0 2012-01-25 20:44:20                      </div>



<div>0x81a897a8 services.exe            684    640     15      272      0      0 2012-01-25 20:44:20</div><div>[snip]</div><div><br></div><div>It also worked fine for the win7 vmsn:</div><div><br></div><div><div>=================================================</div>



<div>VMSN - Windows 7 SP0 x86 @ 512 MB RAM</div><div><br></div><div>$ python vol.py -d -f Abraham-Snapshot2.vmsn --profile=Win7SP0x86 pslist</div><div><div>Volatile Systems Volatility Framework 2.1_alpha</div>

</div><div>[snip]</div><div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div></div><div>DEBUG   : volatility.plugins.addrspaces.vmware: RegionCount: 1</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: Virtual Address:          0, Physical Address:        0, Size: 20000000</div>



<div>DEBUG   : volatility.plugins.addrspaces.vmware: dtb: 185000</div><div>DEBUG   : volatility.utils    : Succeeded instantiating &lt;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile object at 0x102a1a750&gt;</div>



<div>Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                Exit                </div><div><div>---------- -------------------- ------ ------ ------ -------- ------ ------ -------------------- --------------------</div>



</div><div>0x83f2f730 System                    4      0     93      494 ------      0 2012-03-15 15:04:12                      </div><div>0x84f32c48 smss.exe                252      4      2       29 ------      0 2012-03-15 15:04:12                      </div>



<div>0x85708d40 csrss.exe               364    356      9      386      0      0 2012-03-15 15:04:48                      </div><div>0x82050030 wininit.exe             400    356      3       75      0      0 2012-03-15 15:04:48                      </div>



<div>0x856d9370 csrss.exe               408    392      7      201      1      0 2012-03-15 15:04:48                      </div><div>0x8207f030 services.exe            468    400      8      198      0      0 2012-03-15 15:04:49                      </div>



<div>0x8208e030 lsass.exe               476    400      8      711      0      0 2012-03-15 15:04:49 </div><div>[snip]</div></div><div><br></div><div>I then reproduced the same thing Jesse is seeing on the server 2008 x64 w/ 4 GB:</div>



<div><br></div><div><div>=================================================</div><div>VMSS - Server 2008 SP1 x64 @ 4 GB RAM</div><div><br></div><div>$ python vol.py -d -f Win2008SP1x64-9de64630.vmss --profile=Win2008SP1x64 pslist</div>


<div>
<div>Volatile Systems Volatility Framework 2.1_alpha</div></div><div>[snip]</div><div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32&#39;&gt; </div>


</div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64&#39;&gt; </div><div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div>


<div>
<div>DEBUG   : volatility.plugins.addrspaces.vmware: Read region count from file: 2</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: RegionCount: 2</div><div>DEBUG   : volatility.plugins.addrspaces.vmware: Virtual Address:          0, Physical Address:        0, Size: C0000000</div>



<div>Virtual Address:  100000000, Physical Address: C0000000, Size: 40000000</div></div><div>DEBUG   : volatility.plugins.addrspaces.vmware: dtb: 124000</div><div>DEBUG   : volatility.utils    : Succeeded instantiating &lt;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile object at 0x102a1a750&gt;</div>


<div>
<div>DEBUG   : volatility.utils    : Voting round</div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64&#39;&gt; </div>


<div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div>


<div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.amd64.AMD64PagedMemory&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Succeeded instantiating &lt;volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x1036c91d0&gt;</div>


<div>
<div>DEBUG   : volatility.utils    : Voting round</div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64&#39;&gt; </div>


<div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.vmware.VMWareSnapshotFile&#39;&gt; </div>



<div>DEBUG   : volatility.utils    : Failed instantiating (exception): unpack requires a string argument of length 4</div><div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.amd64.AMD64PagedMemory&#39;&gt; </div>



<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.intel.JKIA32PagedMemory&#39;&gt; </div></div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.legacyintel.IA32PagedMemoryPae&#39;&gt; </div>



<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.intel.JKIA32PagedMemoryPae&#39;&gt; </div><div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.legacyintel.IA32PagedMemory&#39;&gt; </div>


<div>
<div>DEBUG   : volatility.utils    : Trying &lt;class &#39;volatility.plugins.addrspaces.standard.FileAddressSpace&#39;&gt; </div></div><div>Offset(V)          Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                Exit                </div>


<div>
<div>------------------ -------------------- ------ ------ ------ -------- ------ ------ -------------------- --------------------</div></div><div>0xfffffa8003ca8950 System                    4      0    104      496 ------      0 2012-03-02 07:16:23                      </div>



<div>&gt; /Users/Michael/volatility_pe_exceptions/volatility/plugins/overlays/windows/windows.py(262)windows_to_unix_time()</div><div>-&gt; unix_time = windows_time / 10000000</div><div><div>(Pdb) windows_time</div><div>


&lt;NoneObject: Unable to read 8 bytes from 18446738026473744904&gt;</div>
</div></div><div><br></div><div>You can see the error occurred because windows_time at 0xfffffa8004a86a08L (hex value of the decimal offset above) could not be fetched from the vmss file. Since it appears the System process is able to be found, we should be able to break into a volshell (which uses the System process AS by default) and try some checks:</div>



<div><br></div><div>$ python vol.py -d -f Win2008SP1x64-9de64630.vmss --profile=Win2008SP1x64 volshell</div><div><div>Current context: process System, pid=4, ppid=0 DTB=0x124000</div><div>Welcome to volshell! Current memory image is:</div>



<div>file:///Users/Michael/Downloads/Win2008SP1x64-9de64630.vmss</div><div>To get help, type &#39;hh()&#39;</div></div><div><div>&gt;&gt;&gt; self.addrspace.is_valid_address(0xfffffa8004a86a08L)</div><div>True</div><div>


&gt;&gt;&gt; self.addrspace.vtop(0xfffffa8004a86a08L)</div>
<div>5354580488L</div><div>&gt;&gt;&gt; dd(0xfffffa8004a86a08L)</div><div>Memory unreadable at fffffa8004a86a08</div></div><div><br></div><div>So the AS thinks the virtual address is valid and is able to vtop, but then when you try to read (dd command) it fails. The first thing that catches my eye is the physical address is reportedly 5354580488L, which is much larger than the size of the file we have:</div>



<div><br></div><div><div>$ ls -al Win2008SP1x64-9de64630.vmss</div><div>-rw-r--r--@ 1 Michael  staff  4300360567 Jul  6 16:01 /Users/Michael/Downloads/Win2008SP1x64-9de64630.vmss</div></div><div><br></div><div>This is the same thing we saw recently in the issue &quot;vtop and 5GB 64bit memory dump problem&quot; [1]. That too was an issue of vmware memory files (a vmem in this case unless Sebastien changed the extension). Same symptom, but with the AMD64 AS - it reported vtop as being a physical address much bigger than the file.</div>



<div><br></div><div>We&#39;re still looking into it some things, and although your AS could use a little work to conform its style with the other AS&#39;s, I&#39;m not sure its the cause of the problem we&#39;re seeing here (unless the AMD64 AS has the same problem). </div>



<div><br></div><div>Stay tuned.... ;-)</div><div><br></div><div>MHL</div><div><br></div><div>[1].  <a href="http://code.google.com/p/volatility/issues/detail?id=272" target="_blank">http://code.google.com/p/volatility/issues/detail?id=272</a></div>


<div><div>
<br><div class="gmail_quote">On Fri, Jul 6, 2012 at 5:58 PM, nir izraeli <span dir="ltr">&lt;<a href="mailto:nirizr@gmail.com" target="_blank">nirizr@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<div dir="ltr">hi Michael,<div>would you mind to also post your comments at the tracking system?</div><div>it&#39;ll be a lot easier for me to keep track of it. hoping I&#39;m not stepping on your tows.</div><div><br></div>





<div>about the zread() - i didn&#39;t implement it, I got confused with a few old AS classes that had unnecessary methods and probably also removed the zread() by mistake.</div><div><br></div><div>I hope to fix these in a couple of days and resubmit an updated version.</div>





<div><br></div><div>the only issue i have trouble with is the conversion to the internal object system.</div><div>I tried using it a couple of times but had trouble with it.</div><div>it would also duplicate efforts for writing modifications to the vmss parsing code.</div>





<div>since it does seem to be easy to write structures using Volatility&#39;s framework,</div><div>would you mind taking care of it yourselves?</div><div>I could add a textual documentation if you&#39;d rather, since i&#39;ll write one anyway. </div>





<div>although if it&#39;s important i could give it another try...<br><br>Thanks,</div><div>Nir<div><div><br><br><div class="gmail_quote">On Fri, Jul 6, 2012 at 11:49 PM, Michael Cohen <span dir="ltr">&lt;<a href="mailto:scudette@gmail.com" target="_blank">scudette@gmail.com</a>&gt;</span> wrote:<br>





<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">It looks to me like the address space is not implementing zread()<br>
properly (or at all). Can you please make sure that you are<br>
implementing zread() in such a way that when you read outside a valid<br>
or mapped region you will receive a null padded buffer rather than<br>
None?<br>
<br>
Some more comments about the address space VMWareSnapshotFile:<br>
   - Please do not use inner classes. There is no need to have a class<br>
defined in such a way - just place the class at the module level.<br>
   - Minor style issues - long lines should be wrapped at 80 chars,<br>
commented out lines should be removed.<br>
   - Do no use double underscore member variable names (they mean<br>
something specific e.g. self.__hasseek).<br>
   - It would also be nicer if we used the volatility object system<br>
rather than struct module directly for parsing these things - it would<br>
make the file formats more readable and simplify the code a lot.<br>
<br>
Thanks<br>
<span><font color="#888888">Michael.<br>
</font></span><div><div><br>
On 6 July 2012 16:03, Jesse Bowling &lt;<a href="mailto:jessebowling@gmail.com" target="_blank">jessebowling@gmail.com</a>&gt; wrote:<br>
&gt; Disclaimer:<br>
&gt;<br>
&gt; So I took Nir&#39;s files, and dropped them into my plugins folder...I did not<br>
&gt; see any new plugins using vol.py -h, and when I tried to do an imageinfo I<br>
&gt; got:<br>
&gt;<br>
&gt; /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss imageinfo<br>
&gt;<br>
&gt; Volatile Systems Volatility Framework 2.1_alpha<br>
&gt; Determining profile based on KDBG search...<br>
&gt;<br>
&gt; Traceback (most recent call last):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 173, in<br>
&gt; &lt;module&gt;<br>
&gt;     main()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 164, in<br>
&gt; main<br>
&gt;     command.execute()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/commands.py&quot;,<br>
&gt; line 101, in execute<br>
&gt;     func(outfd, data)<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/imageinfo.py&quot;,<br>
&gt; line 34, in render_text<br>
&gt;     for k, v in data:<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/imageinfo.py&quot;,<br>
&gt; line 44, in calculate<br>
&gt;     suglist = [ s for s, _, _ in kdbg.KDBGScan.calculate(self)]<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/kdbgscan.py&quot;,<br>
&gt; line 119, in calculate<br>
&gt;     for offset in scanner.scan(aspace):<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/kdbgscan.py&quot;,<br>
&gt; line 83, in scan<br>
&gt;     for offset in scan.BaseScanner.scan(self, address_space, offset,<br>
&gt; maxlen):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/scan.py&quot;, line<br>
&gt; 136, in scan<br>
&gt;     skip = max(skip, s.skip(data, i))<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py&quot;,<br>
&gt; line 49, in skip<br>
&gt;     nextval = data.index(self.tag, offset + 1)<br>
&gt; AttributeError: &#39;NoneType&#39; object has no attribute &#39;index&#39;<br>
&gt;<br>
&gt; So:<br>
&gt;<br>
&gt; # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss psscan<br>
&gt;<br>
&gt; Volatile Systems Volatility Framework 2.1_alpha<br>
&gt;  Offset(P)  Name             PID    PPID   PDB        Time created<br>
&gt; Time exited<br>
&gt; ---------- ---------------- ------ ------ ----------<br>
&gt; ------------------------ ------------------------<br>
&gt; No suitable address space mapping found<br>
&gt; Tried to open image as:<br>
&gt;  WindowsHiberFileSpace32: No base Address Space<br>
&gt;  VMWareSnapshotFile: No base Address Space<br>
&gt;  WindowsCrashDumpSpace32: No base Address Space<br>
&gt;  AMD64PagedMemory: No base Address Space<br>
&gt;  JKIA32PagedMemory: No base Address Space<br>
&gt;  JKIA32PagedMemoryPae: No base Address Space<br>
&gt;  IA32PagedMemoryPae: Module disabled<br>
&gt;  IA32PagedMemory: Module disabled<br>
&gt;  WindowsHiberFileSpace32: No xpress signature found<br>
&gt;  WindowsHiberFileSpace32: No xpress signature found<br>
&gt;  VMWareSnapshotFile: (&#39;Header signature invalid&#39;, <a href="tel:4026597203" value="+14026597203" target="_blank">4026597203</a>)<br>
&gt;  WindowsCrashDumpSpace32: Header signature invalid<br>
&gt;  AMD64PagedMemory: Incompatible profile WinXPSP2x86 selected<br>
&gt;  JKIA32PagedMemory: Failed valid Address Space check<br>
&gt;  JKIA32PagedMemoryPae: Failed valid Address Space check<br>
&gt;  IA32PagedMemoryPae: Module disabled<br>
&gt;  IA32PagedMemory: Module disabled<br>
&gt;  FileAddressSpace: Must be first Address Space<br>
&gt;<br>
&gt; At least it doesn&#39;t crash. So now:<br>
&gt;<br>
&gt; # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss<br>
&gt; --profile=Win2008R2SP1x64 psscan<br>
&gt;<br>
&gt; Volatile Systems Volatility Framework 2.1_alpha<br>
&gt;  Offset(P)  Name             PID    PPID   PDB        Time created<br>
&gt; Time exited<br>
&gt; ---------- ---------------- ------ ------ ----------<br>
&gt; ------------------------ ------------------------<br>
&gt; Traceback (most recent call last):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 173, in<br>
&gt; &lt;module&gt;<br>
&gt;     main()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 164, in<br>
&gt; main<br>
&gt;     command.execute()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/commands.py&quot;,<br>
&gt; line 101, in execute<br>
&gt;     func(outfd, data)<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py&quot;,<br>
&gt; line 415, in render_text<br>
&gt;     for eprocess in data:<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py&quot;,<br>
&gt; line 405, in calculate<br>
&gt;     for offset in PoolScanProcess().scan(address_space):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/scan.py&quot;, line<br>
&gt; 218, in scan<br>
&gt;     for i in BaseScanner.scan(self, address_space, offset, maxlen):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/scan.py&quot;, line<br>
&gt; 136, in scan<br>
&gt;     skip = max(skip, s.skip(data, i))<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py&quot;,<br>
&gt; line 49, in skip<br>
&gt;     nextval = data.index(self.tag, offset + 1)<br>
&gt; AttributeError: &#39;NoneType&#39; object has no attribute &#39;index&#39;<br>
&gt;<br>
&gt; # /usr/local/src/volatility-read-only-may-01/vol.py -f myimage.vmss<br>
&gt; --profile=Win2008R2SP1x64 --dtb=0x187000 psscan<br>
&gt;<br>
&gt; Volatile Systems Volatility Framework 2.1_alpha<br>
&gt;  Offset(P)  Name             PID    PPID   PDB        Time created<br>
&gt; Time exited<br>
&gt; ---------- ---------------- ------ ------ ----------<br>
&gt; ------------------------ ------------------------<br>
&gt; Traceback (most recent call last):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 173, in<br>
&gt; &lt;module&gt;<br>
&gt;     main()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/vol.py&quot;, line 164, in<br>
&gt; main<br>
&gt;     command.execute()<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/commands.py&quot;,<br>
&gt; line 101, in execute<br>
&gt;     func(outfd, data)<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py&quot;,<br>
&gt; line 415, in render_text<br>
&gt;     for eprocess in data:<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/filescan.py&quot;,<br>
&gt; line 405, in calculate<br>
&gt;     for offset in PoolScanProcess().scan(address_space):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/scan.py&quot;, line<br>
&gt; 218, in scan<br>
&gt;     for i in BaseScanner.scan(self, address_space, offset, maxlen):<br>
&gt;   File &quot;/usr/local/src/volatility-read-only-may-01/volatility/scan.py&quot;, line<br>
&gt; 136, in scan<br>
&gt;     skip = max(skip, s.skip(data, i))<br>
&gt;   File<br>
&gt; &quot;/usr/local/src/volatility-read-only-may-01/volatility/plugins/common.py&quot;,<br>
&gt; line 49, in skip<br>
&gt;     nextval = data.index(self.tag, offset + 1)<br>
&gt; AttributeError: &#39;NoneType&#39; object has no attribute &#39;index&#39;<br>
&gt;<br>
&gt; I have limited testing time the next couple weeks, so will look to see if I<br>
&gt; can share this with someone like SA in the meantime...<br>
&gt;<br>
&gt; Cheers,<br>
&gt;<br>
&gt; Jesse<br>
&gt;<br>
&gt;<br>
&gt; On Fri, Jul 6, 2012 at 7:21 AM, nir izraeli &lt;<a href="mailto:nirizr@gmail.com" target="_blank">nirizr@gmail.com</a>&gt; wrote:<br>
&gt;&gt;<br>
&gt;&gt; I assume you need it for something other than test my patch,<br>
&gt;&gt; I can send parts of the vmss of the machine I already noticed more than<br>
&gt;&gt; one region.<br>
&gt;&gt; could you use that to gather the info you need?<br>
&gt;&gt;<br>
&gt;&gt; btw, I&#39;m also using vmware converter standalone pretty often, it might<br>
&gt;&gt; also be related<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; On Fri, Jul 6, 2012 at 5:31 AM, AAron Walters &lt;<a href="mailto:awalters@4tphi.net" target="_blank">awalters@4tphi.net</a>&gt; wrote:<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Nir,<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt;&gt; AAron - actually it was quite rare, but the first vmss I used to test<br>
&gt;&gt;&gt;&gt; the patch<br>
&gt;&gt;&gt;&gt; had two or three, which made my patch break when i first tested it on<br>
&gt;&gt;&gt;&gt; other<br>
&gt;&gt;&gt;&gt; VMs.<br>
&gt;&gt;&gt;&gt; I could try to pinpoint it, but i guess it would be easier for me to<br>
&gt;&gt;&gt;&gt; reverse<br>
&gt;&gt;&gt;&gt; the vmware code than try it manually :)<br>
&gt;&gt;&gt;&gt; A thing to note is that that vmss also had two virtual CPUs, which might<br>
&gt;&gt;&gt;&gt; have<br>
&gt;&gt;&gt;&gt; caused having more than one region. it also had ~4G of RAM. most of the<br>
&gt;&gt;&gt;&gt; other<br>
&gt;&gt;&gt;&gt; VMs i used only had about 512M.<br>
&gt;&gt;&gt;&gt; did you try to run it on other vmss files that resemble the one i<br>
&gt;&gt;&gt;&gt; described?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Interesting.  I have never seen a vmss with multiple regions. If you<br>
&gt;&gt;&gt; happen to come across one again, please let me know. I&#39;d be interested in<br>
&gt;&gt;&gt; what conditions or what product leads to more than one region.<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Thanks,<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; AW<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; --<br>
&gt; Jesse Bowling<br>
&gt;<br>
&gt;<br>
&gt;<br>
</div></div><div><div>&gt; _______________________________________________<br>
&gt; Vol-users mailing list<br>
&gt; <a href="mailto:Vol-users@volatilityfoundation.org" target="_blank">Vol-users@volatilityfoundation.org</a><br>
&gt; <a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
&gt;<br>
</div></div></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
Vol-users mailing list<br>
<a href="mailto:Vol-users@volatilityfoundation.org" target="_blank">Vol-users@volatilityfoundation.org</a><br>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
<br></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div></div>
</blockquote></div><br>