volatilityfoundation / volatilityfoundation/volatility3
Support for process explorer/procdump dmp files
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
Hi
Describe the bug
Trying to run volatility3 commands for dmp file created by sysinternals process explorer (full dump) for a specific process.
When running any command on that memdump I get this error
**Unsatisfied requirement plugins.Info.primary: Memory layer for the kernel
Unsatisfied requirement plugins.Info.nt_symbols: Windows kernel symbols
A symbol table requirement was not fulfilled. Please verify that:
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner
A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.Info.primary', 'plugins.Info.nt_symbols']**
The latest windows.zip symbols have been downloaded and placed under
/volatility3/volatility/symbols/
When running commands against full memdumps such as seen here
https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples
Volatility works fine
So at this point i'm not sure if the issue is that volatility doesn't support memdumps provided by processExplorer/Procdump or I need to do something else with regards to the symbols. If this is a matter of memdump type not supported perhaps a clearer error message will do the trick.
Could be related to this?
https://github.com/volatilityfoundation/volatility3/issues/155
Context
Volatility Version: Volatility 3 Framework 1.2.1-beta.1
Operating System: Windows 10 using WSL with Ubuntu 20.04.1 LTS
Python Version: 3.8.2
10x in advance!!!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing a Volatility 3 command with a full dump created by Process Explorer or ProcDump, using the symbols under /volatility3/volatility/symbols/, and compare it with the working memory samples linked in the issue. Review issue #155 and determine whether the dump format is unsupported or whether the unmet kernel-layer and symbol requirements need a clearer diagnostic; done means documenting the cause and expected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100