linux.pslist returns no results

[RafaelAybar]

Volatily 3 is not able to find plugins
I made a memory dump with Lime in raw format, and i wanted to process it with Volatility3. I have installed all dependencies even the optional dependencies.

Context
Volatility Version: Volatility 3 Framework 2.0.0 Beta
Operating System: Debian Testign
Python Version: 3.9.1
Kernel Version: 5.9.0.5-amd64
Command: python3 vol.py -vvvv -s symbols/ --file /linux.mem linux.bash.Bash

To Reproduce
1- Run a python3 setup.py install
2- Generate JSON file with dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-5.9.0.5-amd64 > output.json

Expected behavior
Volatility3 shoud find the plugins

Command output

https://pastebin.com/vdW3s7Ar

[ikelos]

So this has nothing to with the plugins. It clearly says that it can't determine the information it needs to load the layer (and therefore can't find the symbols it might need). When using dwarf2json you should also use the System.map, because the debugging kernel may not contain all the necessary symbols. You can then also check that the symbols you've created (output.json) live in the volatility/symbols/linux directory, and show up in the output of the isfinfo plugin (this can take a long time to run if you have lots of symbol files). Once it's in there, you should see which banner it's looking for, and you can then run the banners plugin against your image and see if any of the banners it finds match the ones in the ISF file. Please report back the results of these steps, and if you're still experiencing difficulty after that... 5:)

[RafaelAybar]

Hi, tanks a lot for your fast answer, i uncompressed the linux.zip file, and commpresed the folder linux with output.json in order to generate another linux.zip file. Also, i have installed jsonschema beacuse it's another dependency.

Here you are the logs: https://pastebin.com/681Jv8yW

[ikelos]

Ok, it looks like the symbol file is loaded correctly. Now you have to check your memory image to make sure that the banner (Linux version 5.9.0-5-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-1) 10.2.1 20201207, GNU ld (GNU Binutils for Debian) 2.35.1) #1 SMP Debian 5.9.15-1 (2020-12-17)) appears exactly within the memory image, otherwise volatility won't decide to use it. I'd recommend trying the banners plugin to see if volatility can find anything similar within the image. Please remember, it must match exactly for volatility to make use of it...

[RafaelAybar]

Hi again, i have tried to run the banner plugin, but i am too confused, i will generate another memory dump with Lime using the current Kernel, here you are the logs. https://pastebin.com/ZqJePSPD

[ikelos]

Well, the output from banners matches the output.json file you made, so it should be finding that within the memory image? I'm not sure how to debug this further without a copy of the memory image?

[RafaelAybar]

Okey, can I send you an email with the memory dump throug gdrive or wetransfer?

[ikelos]

Hiya, you can share it via gdrive with mike.auty@gmail.com and I'll pick it up. I can let you know once I've got it...

[ikelos]

Thanks I can confirm I've got it. I'll try to find some time to look at it in the next couple of week...

[ikelos]

Hiya, I've managed to take a look into this, but I'm having difficulty tracking down the packages needed for this kernel. I found one with a matching kernel, but it was built with a different compiler for backports. Ever jiggering the banner constant_data didn't allow it to output any data (which is likely due to a system.map that doesn't match the system we're analyzing. Would you be able to provide the JSON file you said that you generated from the original linux-kernel-dbg package please?

[RafaelAybar]

Yes of course!

[No-Github]

I have the same problem, is there a further solution?

python3 vol.py -vvvv -s volatility3/framework/symbols/linux/ isfinfo

python3 vol.py -vvvv -f cyq.vmem banners

python3 vol.py -vvvv -f cyq.vmem linux.bash.Bash

python3 vol.py -vvvv -c /pentest/volatility3/volatility3/framework/symbols/linux/Ubuntu1804.json -f cyq.vmem linux.bash.Bash

python3 vol.py -vvvv -s volatility3/framework/symbols/linux/ -f cyq.vmem linux.bash.Bash

[ikelos]

Thanks for the additional information @No-Github. It looks as though despite the banner and the isfinfo both being in place, volatility isn't finding the isf's banner in the memory image. It's not clear why that is, but it should report whenever it finds a banner it knows about, so that's the area to target.

In your third screenshot the -c command is used for a save configuration, but you also suggested that isfinfo already found the JSON file, so there shouldn't be a need to provide it again (and if you did, you'd use -s to specify an additional symbols directory, rather than a -c to specify plugin configuration options.

Lastly whilst the screenshots are compact, they're also squashed up and so can be difficult to read. At the moment, it looks like the banners output and the isfinfo output match exactly, but even a slight difference may mean that we get the results we're seeing.

I'll try and get on this at some point, but I haven't found the time yet I'm afraid...

[ikelos]

Just as an update to this, we've now got an image whose banner gets detected, but pslist doesn't provide any output and doesn't indicate that the profile is bad in any way, so that's what we're gonna look into next... 5:)

[kmef78]

@ikelos I think I'm having a similar issue.

Output from banners on memory dump: Linux version 4.19.0-14-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.171-2 (2021-01-30)

Output from isfInfo: file:///home//volatility3/symbols/deb.json Unknown 18 7463 141769 1217 - Linux version 4.19.0-14-arm64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.171-2 (2021-01-30)

Not sure its exactly what @No-Github is experiencing but just thought I'd share. I was able to build a functioning profile in Vol2 for this memory dump. If that matters I'm not sure.

[ikelos]

I think someone else on the community slack has run into this issue. Here's the lines that look relevant from the output:

# python3 vol.py -vvvv -f /tmp/dump.mem linux.bash.Bash
Volatility 3 Framework 1.0.1
INFO     volatility3.framework.automagic: Detected a linux category plugin
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
...
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
DEBUG    volatility3.framework.automagic.linux: Identified banner: b'Linux version 3.10.0-957.el7.x86_64 (mockbuild@x86-040.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) ) #1 SMP Thu Oct 4 20:48:51 UTC 2018\n\x00'
...
DEBUG    volatility3.framework.symbols: Unresolved reference: LintelStacker1!...
DEBUG    volatility3.framework.automagic.linux: Linux ASLR shift values determined: physical 71000000 virtual 22c00000
DEBUG    volatility3.framework.automagic.linux: DTB was found at: 0x72c10000
Level 8  volatility3.framework.automagic.stacker: Stacked IntelLayer using LinuxIntelStacker
...
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'LimeLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
Level 9  volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.Bash.vmlinux
DEBUG    volatility3.framework.automagic.symbol_finder: Identified banner: b'Linux version 3.10.0-957.el7.x86_64 (mockbuild@x86-040.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) ) #1 SMP Thu Oct 4 20:48:51 UTC 2018\n\x00'
DEBUG    volatility3.framework.automagic.symbol_finder: Using symbol library: file:///tmp/volatility3/volatility3/symbols/linux/3.10.0-957.el7.x86_64.json.xz
DEBUG    volatility3.framework.symbols: Unresolved reference: vmlinux1!...
DEBUG    volatility3.framework.automagic.linux: Linux ASLR shift values determined: physical -fffe4f000000 virtual 22c00000

I can't tell whether the negative physical offset is important at this point or not?

[RafaelAybar]

@atcuno @ikelos Hi, any news?

[ikelos]

@atcuno Have you had any time to investigate this?

[atcuno]

@ikelos do you have a sample still that exhibits this behaviour?

[ikelos]

Yep, I've got the sample we were originally sent.

[oxnan]

Just want to add to this, that I am having the same problem as above. I have a symbol.json which shows the exact same banner as the isfinfo command.

Do you guys have an ETA on a fix?

[ikelos]

I'm afraid not @oxnan, we don't know for certain what's causing the problem. I'd imagine that the ISF files aren't accurate for some reason. The one sample we had I wasn't able to find a suitable debug kernel for it, so it's still not clear if it's just a mismatch or something deeper...

[oxnan]

I was looking at it a lot as well, but i have been unable to find the root cause :/

Hopefully you find the solution soon

[oxnan]

My problem might be unrelated tho, as I am getting the following errors in my logs:

Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel.layer_name
Level 9  volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: QemuSuspendLayer
Level 9  volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayer
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['QemuSuspendLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
Level 9  volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.Bash.kernel.symbol_table_name

[ikelos]

@oxnan it looks as though your version isn't able to find an appropriate ISF JSON file for the image you're running against. That is a different issue, and I'd recommend reading through here or searching here to find a solution.

[oxnan]

Already made 2 custom ISF jsons using dwarf2json, both one with the system.map and one without. Both are in a folder that is loaded in with the -s parameter. Both using the debug kernel. They are showing up in the isfinfo command, but not being run against it. I thought it might be because of the qemu format, but seem like it should be supported

[ikelos]

It should, and I'm surprised they haven't worked. I don't think the Qemu layer is relevant, but you can always eliminate it from the equation using the layerwriter. Also, you should only put one or the other of the ISF files in the directory, otherwise the automagic always chooses the first one it comes across (which may not work as well). You could trying adding more -v flags (up tro 7) to see if it gives you any more information about the situation?

[oxnan]

I already did the process with layerwriter.LayerWriter but it is the first time I have used it so not sure what it was supposed to do. I extracted the Primary layer so I am primarily working on that. I only have one of the ISF files in the symbols folder, and with -v{7} it gives me the following output:

$ vol3 -f primary.raw -s symbols/ -vvvvvvv --offline linux.bash.Bash
[2612273] WARNING: file already exists but should not: /tmp/_MEIAYVhlQ/Crypto/Cipher/_AES.cpython-38-x86_64-linux-gnu.so
[2612273] WARNING: file already exists but should not: /tmp/_MEIAYVhlQ/Crypto/Cipher/_ARC4.cpython-38-x86_64-linux-gnu.so
[2612273] WARNING: file already exists but should not: /tmp/_MEIAYVhlQ/Crypto/Cipher/_DES.cpython-38-x86_64-linux-gnu.so
[2612273] WARNING: file already exists but should not: /tmp/_MEIAYVhlQ/Crypto/Hash/_SHA256.cpython-38-x86_64-linux-gnu.so
Volatility 3 Framework 2.0.0: Patched as of 20220105
INFO     volatility3.cli: Volatility plugins path: ['/usr/bin/plugins', '/usr/share/Volatility3/plugins', '/tmp/_MEIAYVhlQ/volatility3/plugins', '/tmp/_MEIAYVhlQ/volatility3/framework/plugins']
INFO     volatility3.cli: Volatility symbols path: ['/temp/symbols', '/usr/bin/symbols', '/usr/share/Volatility3/symbols', '/tmp/_MEIAYVhlQ/volatility3/symbols', '/tmp/_MEIAYVhlQ/volatility3/framework/symbols']
Level 6  volatility3.framework: Importing from the following paths: /usr/bin/plugins, /usr/share/Volatility3/plugins, /tmp/_MEIAYVhlQ/volatility3/plugins, /tmp/_MEIAYVhlQ/volatility3/framework/plugins
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/automagic
INFO     volatility3.framework.automagic: Detected a linux category plugin
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash.kernel
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel.layer_name
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash.kernel.layer_name
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel.layer_name
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash.kernel
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.Bash.kernel.symbol_table_name
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash.kernel.symbol_table_name
Level 9  volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.Bash.kernel.symbol_table_name
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash.kernel
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel
Level 9  volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.Bash
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 6  volatility3.framework.automagic.construct_layers: Construction Exception occurred: Unexpected config value found: None
INFO     volatility3.framework.automagic: Running automagic: LinuxBannerCache
Level 6  volatility3.framework.symbols.intermed: Searching for symbols in /temp/symbols, /usr/bin/symbols, /usr/share/Volatility3/symbols, /tmp/_MEIAYVhlQ/volatility3/symbols, /tmp/_MEIAYVhlQ/volatility3/framework/symbols
INFO     volatility3.framework.automagic.symbol_cache: Building linux caches...
Level 7  volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
Level 6  volatility3.framework: Importing from the following paths: /tmp/_MEIAYVhlQ/volatility3/framework/layers
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
Level 6  volatility3.framework.layers.elf: Exception: Bad magic 0xf000ff53 at file offset 0x0
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
Level 8  volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
INFO     volatility3.framework.automagic.linux: No Linux banners found - if this is a linux plugin, please check your symbol files location
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel.layer_name
Level 9  volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayer
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['FileLayer']
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
Level 9  volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.Bash.kernel.symbol_table_name
INFO     volatility3.framework.automagic: Running automagic: KernelModule
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel.layer_name
Level 9  volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.Bash.kernel

Unsatisfied requirement plugins.Bash.kernel: Linux kernel
Unable to validate the plugin requirements: ['plugins.Bash.kernel']

[ikelos]

Hmmmm, just one thing to check (and this will hopefully be going away soon, depending on #630) but the linux ISF files must be under symbols/linux and similarly mac ones must be under symbols/mac. That's a requirement that we hope to remove with #630, but it's a sizable change so it needs a bit more testing.

If that still fails, then we'd need to debug what's going on which either means diving into the code and adding print statements, or being happy to share the image and JSON file you've created with us, so we can look into it. Let me know if the directory thing works first, and then if not we can go from there. Also happy for you to spin up your own ticket if you'd like so we don't swamp Rafael's issue. 5:)

[gitter-sudo]

Hi.
I used dwarf to create json symbols file related to the Linux kernel of the host from which I captured RAM via fmem module.
Then I put the json file in the volatility symbols folder and tried to use linux.pslist.PsList plugin.Output below:
Volatility 3 Framework 2.5.0
Progress: 100.00 Stacking attempts finished
OFFSET (V) PID TID PPID COMM

-end of output-
It looks no process were found
I'm pretty sure symbols file is correct because I tested the same scenario with a wrong json symbols file and I received this output:
Volatility 3 Framework 2.5.0
Progress: 100.00 Stacking attempts finished
Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled. Please verify that:
The associated translation layer requirement was fulfilled
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']
-end of output-

Any idea?

[eve-mem]

If you run the isfinfo plugin, and the banners plugin. Do the banners match exactly? Vol what's them to be exactly the same and won't attempt to use them otherwise.

Could you share the output when running the linux pslist with debug info. (e.g. -vvv before the plugin name)

[gitter-sudo]

Hi @eve-mem ,this is the output of the isinfo command:
@@@
Volatility 3 Framework 2.5.0
Progress: 100.00 PDB scanning finished
URI Valid Number of base_types Number of types Number of symbols Number of enums Identifying information

file:///home/user/Desktop/volatility3/volatility3/symbols/windows/ntkrnlmp.pdb/BBCA518265E9D831935C4FC58E2542ED-1.json.xz True (cached) 16 1653 40028 293 b'ntkrnlmp.pdb|BBCA518265E9D831935C4FC58E2542ED|1'
file:///home/user/Desktop/volatility3/volatility3/symbols/vmlinux-5.15.0-83-generic.json True (cached) 19 12077 194828 2092 b'Linux version 5.15.0-83-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #92-Ubuntu SMP Mon Aug 14 09:30:42 UTC 2023 (Ubuntu 5.15.0-83.92-generic 5.15.116)\n\x00'
@@@

here the output of the banners command:
@@@
Volatility 3 Framework 2.5.0
Progress: 100.00 PDB scanning finished
Offset Banner

0x77600200 Linux version 5.15.0-83-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #92-Ubuntu SMP Mon Aug 14 09:30:42 UTC 2023 (Ubuntu 5.15.0-83.92-generic 5.15.116)
@@@

and this is the ouput of the -vvv linux.pslist.PsList command (some strikethrough text.I think about some formatting characters.please,ignore it):
@@@
Volatility 3 Framework 2.5.0
INFO volatility3.cli: Volatility plugins path: ['/home/user/Desktop/volatility3/volatility3/plugins', '/home/user/Desktop/volatility3/volatility3/framework/plugins']
INFO volatility3.cli: Volatility symbols path: ['/home/user/Desktop/volatility3/volatility3/symbols', '/home/user/Desktop/volatility3/volatility3/framework/symbols']
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/user/Desktop/volatility3/volatility3/framework/init.py", line 185, in import_file
importlib.import_module(module)
File "/usr/lib/python3.10/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 1006, in _find_and_load_unlocked
File "", line 688, in _load_unlocked
File "", line 883, in exec_module
File "", line 241, in _call_with_frames_removed
File "/home/user/Desktop/volatility3/volatility3/framework/plugins/windows/cachedump.py", line 8, in
from Crypto.Cipher import ARC4, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.cachedump based on file: /home/user/Desktop/volatility3/volatility3/framework/plugins/windows/cachedump.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/user/Desktop/volatility3/volatility3/framework/init.py", line 185, in import_file
importlib.import_module(module)
File "/usr/lib/python3.10/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 1006, in _find_and_load_unlocked
File "", line 688, in _load_unlocked
File "", line 883, in exec_module
File "", line 241, in _call_with_frames_removed
File "/home/user/Desktop/volatility3/volatility3/framework/plugins/windows/hashdump.py", line 10, in
from Crypto.Cipher import AES, ARC4, DES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.hashdump based on file: /home/user/Desktop/volatility3/volatility3/framework/plugins/windows/hashdump.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/user/Desktop/volatility3/volatility3/framework/init.py", line 185, in import_file
importlib.import_module(module)
File "/usr/lib/python3.10/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 1006, in _find_and_load_unlocked
File "", line 688, in _load_unlocked
File "", line 883, in exec_module
File "", line 241, in _call_with_frames_removed
File "/home/user/Desktop/volatility3/volatility3/framework/plugins/windows/lsadump.py", line 8, in
from Crypto.Cipher import ARC4, DES, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.lsadump based on file: /home/user/Desktop/volatility3/volatility3/framework/plugins/windows/lsadump.py
INFO volatility3.cli: The following plugins could not be loaded (use -vv to see why): volatility3.plugins.windows.cachedump, volatility3.plugins.windows.hashdump, volatility3.plugins.windows.lsadump
INFO volatility3.framework.automagic: Detected a linux category plugin
INFO volatility3.framework.automagic: Running automagic: ConstructionMagic
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
INFO volatility3.framework.automagic: Running automagic: SymbolCacheMagic
INFO volatility3.framework.automagic: Running automagic: LayerStacker
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG volatility3.framework.automagic.linux: Identified banner: b'Linux version 5.15.0-83-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.4.0-1ubuntu122.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #92-Ubuntu SMP Mon Aug 14 09:30:42 UTC 2023 (Ubuntu 5.15.0-83.92-generic 5.15.116)\n\x00'
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!assoc_array_ptr
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!netns_ipvs
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!mtd_info
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!can_pkg_stats
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!can_rcv_lists_stats
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!can_dev_rcv_lists
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!mpls_route
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!sctp_mib
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!smc_stats_rsn
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!smc_stats
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!dn_dev
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!garp_port
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!macsec_ops
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!mctp_dev
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!mpls_dev
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!mrp_port
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!tipc_bearer
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!udp_tunnel_nic
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!pcpu_dstats
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!phylink
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!cfg80211_conn
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!cfg80211_cached_keys
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!cfg80211_cqm_config
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!cfg80211_internal_bss
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!sfp
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!libipw_device
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!smc_hashinfo
DEBUG volatility3.framework.symbols: Unresolved reference: LintelStacker1!dsa_8021q_context
DEBUG volatility3.framework.automagic.linux: Scanners could not determine any ASLR shifts, using 0 for both
DEBUG volatility3.framework.automagic.linux: DTB was found at: 0x2e10000
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
Level 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
Level 9 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DEBUG volatility3.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'FileLayer']
INFO volatility3.framework.automagic: Running automagic: SymbolFinder
INFO volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
Level 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG volatility3.framework.automagic.symbol_finder: Identified banner: b'Linux version 5.15.0-83-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.4.0-1ubuntu122.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #92-Ubuntu SMP Mon Aug 14 09:30:42 UTC 2023 (Ubuntu 5.15.0-83.92-generic 5.15.116)\n\x00'
DEBUG volatility3.framework.automagic.symbol_finder: Using symbol library: file:///home/user/Desktop/volatility3/volatility3/symbols/vmlinux-5.15.0-83-generic.json
INFO volatility3.framework.automagic: Running automagic: KernelModule

OFFSET (V) PID TID PPID COMM
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!assoc_array_ptr
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!netns_ipvs
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!mtd_info
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!can_pkg_stats
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!can_rcv_lists_stats
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!can_dev_rcv_lists
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!mpls_route
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!sctp_mib
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!smc_stats_rsn
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!smc_stats
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!dn_dev
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!garp_port
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!macsec_ops
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!mctp_dev
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!mpls_dev
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!mrp_port
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!tipc_bearer
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!udp_tunnel_nic
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!pcpu_dstats
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!phylink
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!cfg80211_conn
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!cfg80211_cached_keys
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!cfg80211_cqm_config
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!cfg80211_internal_bss
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!sfp
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!libipw_device
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!smc_hashinfo
DEBUG volatility3.framework.symbols: Unresolved reference: symbol_table_name1!dsa_8021q_context
@@@

thanks for any tips

[eve-mem]

Great thanks for that, It shows that you have the correct symbols, and vol is finding them in your sample and it's all working, almost as expected.

This is the line where we see that it's been stacked correctly.

DEBUG volatility3.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'FileLayer']

And here showing that your banner was found correctly.

DEBUG volatility3.framework.automagic.symbol_finder: Identified banner: b'Linux version 5.15.0-83-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.4.0-1ubuntu122.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) https://github.com/volatilityfoundation/volatility3/pull/92-Ubuntu SMP Mon Aug 14 09:30:42 UTC 2023 (Ubuntu 5.15.0-83.92-generic 5.15.116)\n\x00'

Rereading your first message I see you say, lime raw format. I missed that at first. Unfortunately 'raw' from LiME means something else than what most people expect, it's the raw main memory but it doesn't preserve the correct layout of memory and that is why vol is failing. It's looking for where the init_task should be, but due to the "raw" format from LiME it's in the wrong place and therefore you get no results. The padded or lime formats should work flawlessly, but you will need to reacquire the memory. Essentially the LiME padded output is what most people would call a raw image.

It's very unfortunate, I've raised an issue for LiME in the hopes that one day the option will be changed or at least come with a warning. 504ensicsLabs/LiME#111

[gitter-sudo]

talking about LiME,I think you made reference to the first post of this thread that is not mine ;)
I used fmem to acquire the memory.Do you think I'm experiencing the same issue you experienced with LiME because fmem create raw output format too?

[eve-mem]

Ah yes. You've added a comment to an existing issue, rather than having your own. Sorry i got confused. I haven't got any experience with fmem personally so i can't say how it compares.

At this point I'd probably need to see the sample myself to try and work out what's going on.

[gitter-sudo]

thanks,meanwhile I'll try using LiME with padded or lime format

[eve-mem]

Great, good luck.

Given this is a three year old issue that's covered a few different people struggling with similar symptoms (no pslist) but different causes (format, making symbols, etc) it feels like this should be closed now. @ikelos do you agree?

@gitter-sudo if you need to raise another similar issue, I'd personally suggest checking in the slack channel first - it's a good quick way to get some community support. Issues are fine too of course, but if you haven't seen the slack channel you might find it helpful.

[gitter-sudo]

thanks @eve-mem ,I confirm that capturing RAM via LiME has allowed me to achieve the expected results

[eve-mem]

Great news, be interesting to investigate what went wrong with fmem in slower time.

[phillip-at-work]

I had the same issue. Using LiME format=padded now shows processes with ps().

[github-actions]

This issue is stale because it has been open for 200 days with no activity.