'connections' plugin breaks with InvalidOffsetError on windows 7 x86 image

[GoogleCodeExporter]

host machine: 32 bit windows 7 w/ python 2.7

C:\Users\admin\Desktop\vol>C:\Python27\python.exe volatility.py connections 
--profile=Win7SP0x86  -f win7vss.vmem
Volatile Systems Volatility Framework 1.4_rc1
Traceback (most recent call last):
  File "volatility.py", line 138, in <module>
    main()
  File "volatility.py", line 129, in main
    command.execute()
  File "C:\Users\admin\Desktop\vol\volatility\commands.py", line 72, in execute
    data = self.calculate()
  File "C:\Users\admin\Desktop\vol\plugins\internal\connections.py", line 56, in calculate
    result = network.determine_connections(addr_space)
  File "C:\Users\admin\Desktop\vol\volatility\win32\network.py", line 104, in determine_connections
    target = obj.Curry(obj.Pointer, '_TCPT_OBJECT'))
  File "C:\Users\admin\Desktop\vol\volatility\obj.py", line 631, in __init__
    parent = parent, name = name)
  File "C:\Users\admin\Desktop\vol\volatility\obj.py", line 301, in __init__
    raise InvalidOffsetError("Invalid Address 0x{0:08X}, instantiating {1}".format(offset, name))
volatility.obj.InvalidOffsetError: Invalid Address 0xC73B2C46, instantiating 
None

Original issue reported on code.google.com by atc...@gmail.com on 18 Aug 2010 at 1:38

• Blocking: [Tracker] Plugins that fail on profiles other than XPSP2 #9
• Merged into: win32/network functions rely on hardcoded offsets into tcpip.sys - need updating and moving to profiles #6

[GoogleCodeExporter]

This suffered the same problems as issue 6, and has been fixed, but still 
doesn't return any results under windows 7.

Marking as a duplicate of issue 6.

Original comment by mike.auty@gmail.com on 18 Aug 2010 at 10:35

• Changed state: Duplicate