volatilityfoundation / volatilityfoundation/volatility3
windows.psscan: Error only when using --physical
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
vol -vvvvvvvvvvvvv -f banking-malware.vmem windows.psscan
Level 6 volatility3.framework.objects: Void size requested
Level 6 volatility3.framework.objects: Void size requested
Level 6 volatility3.framework.objects: Void size requested
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PSP_CPU_QUOTA_APC
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK
3488 636 WmiPrvSE.exe 0x7cf2fb00 16 329 0 False 2020-11-15 03:24:41.000000 N/A Disabled
1832 500 dllhost.exe 0x7d203930 21 195 0 False 2020-11-15 03:24:29.000000 N/A Disabled
3200 500 SDXHelper.exe 0x7d24d2f0 16 302 1 False 2021-02-09 00:51:12.000000 N/A Disabled
3196 500 SDXHelper.exe 0x7d24da30 16 302 1 False 2021-02-09 00:51:12.000000 N/A Disabled
3028 360 conhost.exe 0x7d2508c0 2 33 0 False 2021-02-09 00:51:13.000000 N/A Disabled
2044 500 dllhost.exe 0x7d2735e0 19 207 0 False 2020-11-15 03:24:30.000000 N/A Disabled
2104 500 VSSVC.exe 0x7d2e5060 6 119 0 False 2020-11-15 03:24:31.000000 N/A Disabled
3188 636 dllhost.exe 0x7d2f3580 7 138 1 False 2021-02-09 00:51:25.000000 N/A Disabled
2192 500 taskhost.exe 0x7d33eb00 12 218 1 False 2020-11-15 03:24:33.000000 N/A Disabled
vol -vvvvvvvvvvvvv -f banking-malware.vmem windows.psscan --physical
Level 6 volatility3.framework.objects: Void size requested
Level 6 volatility3.framework.objects: Void size requested
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PSP_CPU_QUOTA_APC
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK
DEBUG volatility3.cli: Traceback (most recent call last):
File "/src/volatility3/volatility3/cli/__init__.py", line 333, in run
renderers[args.renderer]().render(constructed.run())
File "/src/volatility3/volatility3/cli/text_renderer.py", line 178, in render
grid.populate(visitor, outfd)
File "/src/volatility3/volatility3/framework/renderers/__init__.py", line 211, in populate
for (level, item) in self._generator:
File "/src/volatility3/volatility3/framework/plugins/windows/psscan.py", line 183, in _generator
(_, _, offset, _, _) = list(memory.mapping(offset = proc.vol.offset, length = 0))[0]
File "/src/volatility3/volatility3/framework/layers/intel.py", line 203, in mapping
for offset, size, mapped_offset, mapped_size, map_layer in self._mapping(offset, length, ignore_errors):
File "/src/volatility3/volatility3/framework/layers/intel.py", line 236, in _mapping
mapped_offset, _, layer_name = self._translate(offset)
File "/src/volatility3/volatility3/framework/layers/intel.py", line 373, in _translate
return self._translate_swap(self, offset, self._bits_per_register // 2)
File "/src/volatility3/volatility3/framework/layers/intel.py", line 326, in _translate_swap
return super()._translate(offset)
File "/src/volatility3/volatility3/framework/layers/intel.py", line 105, in _translate
entry, position = self._translate_entry(offset)
File "/src/volatility3/volatility3/framework/layers/intel.py", line 134, in _translate_entry
raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry,
volatility3.framework.exceptions.PagedInvalidAddressException: Page Fault at entry 0x0 in table page table
Volatility was unable to read a requested page:
Page error 0x7cf2fb00 in layer layer_name (Page Fault at entry 0x0 in table page table)
* Memory smear during acquisition (try re-acquiring if possible)
* An intentionally invalid page lookup (operating system protection)
* A bug in the plugin/volatility3 (re-run with -vvv and file a bug)
No further results will be produced
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce both commands against banking-malware.vmem, starting in volatility3/framework/plugins/windows/psscan.py at _generator. Trace the --physical path through volatility3/framework/layers/intel.py mapping and translation methods, then run windows.psscan --physical again. Done means the command handles this invalid page without aborting and produces the expected remaining results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100