volatilityfoundation / volatilityfoundation/volatility3

Support for process explorer/procdump dmp files

Open
#341 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
4.4k
Forks
705
Avg merge
1d 10h
Merged PRs (30d)
3

Description

Hi

Describe the bug
Trying to run volatility3 commands for dmp file created by sysinternals process explorer (full dump) for a specific process.
When running any command on that memdump I get this error

**Unsatisfied requirement plugins.Info.primary: Memory layer for the kernel
Unsatisfied requirement plugins.Info.nt_symbols: Windows kernel symbols

A symbol table requirement was not fulfilled. Please verify that:
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner

A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.Info.primary', 'plugins.Info.nt_symbols']**

The latest windows.zip symbols have been downloaded and placed under
/volatility3/volatility/symbols/

When running commands against full memdumps such as seen here
https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples
Volatility works fine

So at this point i'm not sure if the issue is that volatility doesn't support memdumps provided by processExplorer/Procdump or I need to do something else with regards to the symbols. If this is a matter of memdump type not supported perhaps a clearer error message will do the trick.

Could be related to this?
https://github.com/volatilityfoundation/volatility3/issues/155

Context
Volatility Version: Volatility 3 Framework 1.2.1-beta.1
Operating System: Windows 10 using WSL with Ubuntu 20.04.1 LTS
Python Version: 3.8.2

10x in advance!!!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing a Volatility 3 command with a full dump created by Process Explorer or ProcDump, using the symbols under /volatility3/volatility/symbols/, and compare it with the working memory samples linked in the issue. Review issue #155 and determine whether the dump format is unsupported or whether the unmet kernel-layer and symbol requirements need a clearer diagnostic; done means documenting the cause and expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.