Re: [Vol-users] Newbie Question: How did 512MB become 4GB? (no pagefile, no pae)

Thanks so much for the comments. The padding to take in the hardware device memory makes sense. ~/dev/volatility-svn $ python vol.py -f ~/memtest/win7.elf vboxinfo Volatile Systems Volatility Framework 2.3_beta Magic: 0xc01ac0de Format: 0x10000 VirtualBox 4.2.12 (revision 84980) CPUs: 1 File Offset Memory Offset Size ----------- ------------- ---------- 0x0000006f0 0x00000000000 0x20000000 0x0200006f0 0x000e0000000 0x01200000 <-- This one [1]? 0x0212006f0 0x000f0000000 0x00400000 <-- Or maybe this one [2]? 0x0216006f0 0x000f0400000 0x00004000 0x0216046f0 0x000ffff0000 0x00010000 (Yes, this is a different elf file. I redid my process to check - same result.) From reading Teuwen's personal wiki, I can see that I could rip out just the system RAM. For those that are wondering, yes, I do know that I can use the elf file directly in 2.3_beta. I was just wondering - 4GB seemed a suspiciously round number. Thanks again. I'll continue to play. Adam On 28/08/13 20:26, Michael Hale Ligh wrote: Hey Adam, Try running the vboxinfo plugin on your .elf file and look at the memory segmentation. Most likely you will see a range starting at 0xE0000000 which is for the virtualbox hardware device memory (vga, pci, etc). The imagecopy plugin will 0-pad your raw dump to be large enough to include those memory segments. This won't happen when you convert formats like crash, hiber, etc into raw because those don't contain the hardware memory ranges to begin with. A bit more info is in the meta-data section of https://code.google.com/p/volatility/wiki/VirtualBoxCoreDump. Hope this helps, MHL On Wed, Aug 28, 2013 at 2:34 PM, Adam Bridge &lt;adam.bridge(a)yahoo.com&gt;wrote: -- If you like, we could go PGP..? _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users