volatilityfoundation / volatilityfoundation/volatility3

windows.psscan: Error only when using --physical

Open
#591 24 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
4.4k
Forks
705
Avg merge
1d 10h
Merged PRs (30d)
3

Description

vol -vvvvvvvvvvvvv -f banking-malware.vmem windows.psscan

Level 6  volatility3.framework.objects: Void size requested
Level 6  volatility3.framework.objects: Void size requested
Level 6  volatility3.framework.objects: Void size requested
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PSP_CPU_QUOTA_APC
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK

3488    636     WmiPrvSE.exe    0x7cf2fb00      16      329     0       False   2020-11-15 03:24:41.000000      N/A     Disabled
1832    500     dllhost.exe     0x7d203930      21      195     0       False   2020-11-15 03:24:29.000000      N/A     Disabled
3200    500     SDXHelper.exe   0x7d24d2f0      16      302     1       False   2021-02-09 00:51:12.000000      N/A     Disabled
3196    500     SDXHelper.exe   0x7d24da30      16      302     1       False   2021-02-09 00:51:12.000000      N/A     Disabled
3028    360     conhost.exe     0x7d2508c0      2       33      0       False   2021-02-09 00:51:13.000000      N/A     Disabled
2044    500     dllhost.exe     0x7d2735e0      19      207     0       False   2020-11-15 03:24:30.000000      N/A     Disabled
2104    500     VSSVC.exe       0x7d2e5060      6       119     0       False   2020-11-15 03:24:31.000000      N/A     Disabled
3188    636     dllhost.exe     0x7d2f3580      7       138     1       False   2021-02-09 00:51:25.000000      N/A     Disabled
2192    500     taskhost.exe    0x7d33eb00      12      218     1       False   2020-11-15 03:24:33.000000      N/A     Disabled

vol -vvvvvvvvvvvvv -f banking-malware.vmem windows.psscan --physical

Level 6  volatility3.framework.objects: Void size requested
Level 6  volatility3.framework.objects: Void size requested
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PSP_CPU_QUOTA_APC
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK


DEBUG    volatility3.cli: Traceback (most recent call last):
  File "/src/volatility3/volatility3/cli/__init__.py", line 333, in run
    renderers[args.renderer]().render(constructed.run())
  File "/src/volatility3/volatility3/cli/text_renderer.py", line 178, in render
    grid.populate(visitor, outfd)
  File "/src/volatility3/volatility3/framework/renderers/__init__.py", line 211, in populate
    for (level, item) in self._generator:
  File "/src/volatility3/volatility3/framework/plugins/windows/psscan.py", line 183, in _generator
    (_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 203, in mapping
    for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(offset, length, ignore_errors):
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 236, in _mapping
    mapped_offset, _, layer_name = self._translate(offset)
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 373, in _translate
    return self._translate_swap(self, offset, self._bits_per_register // 2)
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 326, in _translate_swap
    return super()._translate(offset)
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 105, in _translate
    entry, position = self._translate_entry(offset)
  File "/src/volatility3/volatility3/framework/layers/intel.py", line 134, in _translate_entry
    raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry,
volatility3.framework.exceptions.PagedInvalidAddressException: Page Fault at entry 0x0 in table page table

Volatility was unable to read a requested page:
Page error 0x7cf2fb00 in layer layer_name (Page Fault at entry 0x0 in table page table)

        * Memory smear during acquisition (try re-acquiring if possible)
        * An intentionally invalid page lookup (operating system protection)
        * A bug in the plugin/volatility3 (re-run with -vvv and file a bug)

No further results will be produced

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce both commands against banking-malware.vmem, starting in volatility3/framework/plugins/windows/psscan.py at _generator. Trace the --physical path through volatility3/framework/layers/intel.py mapping and translation methods, then run windows.psscan --physical again. Done means the command handles this invalid page without aborting and produces the expected remaining results.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.