9:57 a.m.
I just build a VM with Debian (I needed to install other packages) and when I run this on
a memory image I get the following (after about 10 minutes). The pslist.txt file is
partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is
believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py",
line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
11:16 p.m.
Hi Sean,
It seems very strange that you’d get a different number of processes with each run.
Coupled with the IOError and the path being /mnt/hgfs (VMware host to guest), I would try
to first rule out something weird with VMware Tools data transfer. Can you copy the memory
dump into your virtual machine and run Volatility against the local file?
MHL
--------------------------------------------------
Michael Ligh (@iMHLv2)
GPG: http://mnin.org/gpg.pubkey.txt
Blog: http://volatility-labs.blogspot.com
On Sep 25, 2014, at 8:57 AM, Sean McLinden <mclinden(a)informed.net> wrote:
I just build a VM with Debian (I needed to install other packages) and when I run this on
a memory image I get the following (after about 10 minutes). The pslist.txt file is
partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is
believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py",
line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
7:59 a.m.
It turns out that it was an error with the memory allocated to the VM.
I had allocated 2G (the VMWare default was 512M) and the memory image was almost 4G. When
I increased the VM RAM to 8G everything worked.
Lucky my host has 64G RAM!
Sean
----- Original Message -----
From: "Michael Ligh" <michael.ligh(a)mnin.org>
To: "Sean McLinden" <mclinden(a)informed.net>
Cc: "Volatility Users" <vol-users(a)volatilityfoundation.org>
Sent: Friday, September 26, 2014 11:16:20 PM GMT -05:00 US/Canada Eastern
Subject: Re: [Vol-users] Error with 2.4 Debian Wheezy
Hi Sean,
It seems very strange that you’d get a different number of processes with each run.
Coupled with the IOError and the path being /mnt/hgfs (VMware host to guest), I would try
to first rule out something weird with VMware Tools data transfer. Can you copy the memory
dump into your virtual machine and run Volatility against the local file?
MHL
--------------------------------------------------
Michael Ligh (@iMHLv2)
GPG: http://mnin.org/gpg.pubkey.txt
Blog: http://volatility-labs.blogspot.com
On Sep 25, 2014, at 8:57 AM, Sean McLinden <mclinden(a)informed.net> wrote:
I just build a VM with Debian (I needed to install other packages) and when I run this on
a memory image I get the following (after about 10 minutes). The pslist.txt file is
partially populated though how far it gets differs with each run.
The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is
believed to be infected with malware.
user@host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in <module>
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
127, in execute
func(outfd, data)
File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py",
line 178, in render_text
str(task.ExitTime or ''),
File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line
219, in table_row
outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument
Thanks for any help.
Sean McLinden
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
--
NOTICE of CONFIDENTIALITY and DISCLAIMER
This transmission, including attachments, is confidential. It may also be privileged or
otherwise protected by work product immunity or other legal rules. If you have received it
by mistake, please let us know by e-mail to the sender, only, and delete it from your
system; you may not copy this message or disclose its contents to anyone.
Unless expressly noted, above, this communication does not reflect an intention by the
sender to conduct a transaction or make any agreement by electronic means. Nothing
contained in this transmission shall constitute a contract or electronic signature under
the ESIGN, any version of the UETA, or any other statute governing electronic
transactions.
If this transmission contains advice, the advice is based on instructions in relation to,
and is provided to the addressee in connection with, the matter mentioned above.
Responsibility is not accepted for reliance upon it by any other person or for any other
purpose.
3701
days inactive
3703
days old
vol-users@lists.volatilityfoundation.org
2 comments
2 participants
participants (2)
-
Michael Ligh -
Sean McLinden