Skip to content
This repository has been archived by the owner on Feb 15, 2021. It is now read-only.

index out of range #12

Closed
nocomp opened this issue Dec 13, 2019 · 1 comment
Closed

index out of range #12

nocomp opened this issue Dec 13, 2019 · 1 comment

Comments

@nocomp
Copy link

nocomp commented Dec 13, 2019

hello folks,
thxx a lot for this great tool i just discovered.
i just gave it a try on a win7 ram image profile and i got an out of range error msg.
anything i can do for solve this?Volatility plugin malfind execution in progress...
Volatility plugin procdump execution in progress...
Volatility plugin idt execution in progress...
Volatility plugin gdt execution in progress...
Volatility plugin driverirp execution in progress...
Volatility plugin deskscan execution in progress...
Volatility plugin timers execution in progress...
Volatility plugin gditimers execution in progress...
Volatility plugin ssdt execution in progress...

Hunting for malicious artifacts in memory...
Traceback (most recent call last):
File "VolDiff.py", line 1811, in
main()
File "VolDiff.py", line 1391, in main
ppids = get_all_ppids("explorer.exe|csrss.exe|wininit.exe|winlogon.exe|system")
File "VolDiff.py", line 595, in get_all_ppids
ppids.append(re.sub(' +', ' ', line).split(' ')[3])
IndexError: list index out of range
nocomp@8uR34ud3sL1c0rn35:~/tools/forensic/VolDiff$

best regards

@H2Cyber
Copy link
Owner

H2Cyber commented Dec 15, 2019

See https://github.com/aim4r/VolDiff/wiki#how-to-install-voldiff-prerequisites
TL;DR: VolDiff has not been tested/working on Windows.

@H2Cyber H2Cyber closed this as completed Dec 15, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants