Re: [Vol-users] KDBG errors

Hello, I'm getting some KDBG errors when examining a Windows Server 2008 R2 server memory image. I saw a similar post to this list back in August 2012 (http://lists.volatilityfoundation.org/pipermail/vol-users/2012-August/00056…) Here's the output from a few plugins. It was captured by another person and I don't know what tool or version he used. Does it look like the memory image is corrupted? Thanks, Carlos $ vol.py -f memdump.mem imageinfo Volatility Foundation Volatility Framework 2.3.1 Determining profile based on KDBG search... Suggested Profile(s) : Win7SP0x64, Win7SP1x64, Win2008R2SP0x64, Win2008R2SP1x64 AS Layer1 : AMD64PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (memdump.mem) PAE type : No PAE DTB : 0x187000L KDBG : 0xf80001def0a0 Number of Processors : 8 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xfffff80001df0d00L Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", line 35, in render_text for k, v in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/imageinfo.py", line 100, in calculate yield ('KPCR for CPU {0}'.format(kpcr.ProcessorBlock.Number), hex(kpcr.obj_offset)) TypeError: hex() argument can't be converted to hex $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 pslist Volatility Foundation Volatility Framework 2.3.1 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/taskmods.py", line 140, in render_text for task in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", line 70, in pslist for p in get_kdbg(addr_space).processes(): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", line 42, in processes raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan") AttributeError: Could not list tasks, please verify your --profile with kdbgscan $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 kdbgscan Volatility Foundation Volatility Framework 2.3.1 ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP1x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP1x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win2008R2SP0x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) ************************************************** Instantiating KDBG using: Kernel AS Win2008R2SP1x64 (6.1.7601 64bit) Offset (V) : 0xf80001def0a0 Offset (P) : 0x1def0a0 KDBG owner tag check : True Profile suggestion (KDBGHeader): Win7SP0x64 Version64 : 0xf80001def068 (Major: 15, Minor: 7601) Service Pack (CmNtCSDVersion) : 1 Build string (NtBuildLab) : 7601.18247.amd64fre.win7sp1_gdr. PsActiveProcessHead : 0xfffff80001e253d0 (0 processes) PsLoadedModuleList : 0xfffff80001e436d0 (0 modules) KernelBase : 0xfffff80001c00000 (Matches MZ: True) Major (OptionalHeader) : 6 Minor (OptionalHeader) : 1 KPCR : 0xfffff80001df0d00 (CPU 0) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) KPCR : - (CPU -) $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 hivescan Volatility Foundation Volatility Framework 2.3.1 Offset(P) ------------------ 0x0000000000431010 0x00000000051a4010 0x000000000f1d7010 0x0000000013e15410 0x0000000015875410 0x000000005a517410 0x000000006e434410 0x000000007ddce410 0x00000000a143e410 0x00000000a7f8c410 0x00000000c3b83010 0x00000000cbb17410 0x00000000d0768410 $ $ $ vol.py -f memdump.mem --profile=Win2008R2SP1x64 svcscan Volatility Foundation Volatility Framework 2.3.1 Traceback (most recent call last): File "/usr/local/bin/vol.py", line 5, in <module> pkg_resources.run_script('volatility==2.3.1', 'vol.py') File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 488, in run_script File "build/bdist.linux-x86_64/egg/pkg_resources.py", line 1354, in run_script File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 183, in <module> main() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/EGG-INFO/scripts/vol.py", line 174, in main command.execute() File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/commands.py", line 121, in execute func(outfd, data) File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", line 360, in render_text for rec in data: File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/malware/svcscan.py", line 275, in calculate for task in tasks.pslist(addr_space): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/win32/tasks.py", line 70, in pslist for p in get_kdbg(addr_space).processes(): File "/usr/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/plugins/overlays/windows/kdbg_vtypes.py", line 42, in processes raise AttributeError("Could not list tasks, please verify your --profile with kdbgscan") AttributeError: Could not list tasks, please verify your --profile with kdbgscan _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users