-
Notifications
You must be signed in to change notification settings - Fork 429
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unsatisfied requirement plugins.Info.nt_symbols: Windows kernel symbols #96
Comments
I also tried using "Ram Capture" memory image with same error python vol.py -f 20191019_1.mem windows.info |
Hiya, could you please trying running it with |
I hit the same error as @araaj. It looks like the
More precisely, it looks to me that the NT symbol converter is not behaving as it should. So I tried to trigger it manually. Using
And using
Looks like Also, I cannot manage to get the Do you have some insight about this? |
I re-captured the image of the same desktop again with Ram Capture, this time it worked fine. Could be that the image was not acquired correctly before. |
I tried another host. The image was captured using redline and originally to be analyzed in redline. I tried using the .dat file created by redline as memory dump. when parsing pslist using volitality, i get the output along with the error. PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime 4 0 System 0xe001b87bd900 287 - N/A False 2019-07-05 08:29:18.000000 N/A C:>vol.exe -vvv -f w32memory-acquisition-100.urn_uuid_32a91b60-c2ae-4c39-be81-40c5f7e66389.dat windows.pslist Unsatisfied requirement plugins.PsList.nt_symbols: Windows kernel symbols A symbol table requirement was not fulfilled. Please verify that: Unable to validate the plugin requirements: ['plugins.PsList.nt_symbols'] |
@araaj Thanks, for trying again. Acquisition issues can make it difficult for volatility to complete its job and there's not a great deal we can do about that I'm afraid. The second issue you've mentioned, the first run seems like it ran fine, but the encountered an invalid address during the processing of the pslist linked list. We now try hard not to hide errors from users, but allow them to make an informed decision about the results they've got. So in this instance, it output as much as it could, but then failed and showed you where and why it failed:
which suggests one of the pages that the page directory pointed as was invalid. The second run is more interesting, and again it may be an acquisition issue, whereby it tried all three kernel detection methods it has, and the third one found a potential DTB at 0x82800000, which it then tried to reference, but it turned out that address wasn't valid. Again, not sure what to suggest, but it sounds as though the imaging tool isn't necessarily taking a complete capture? I'm not sure how to help more on that front... 5:S |
@sk4la I can't speak to the docker images, but a git checkout of vol3 and the following command line:
Successfully ran, downloaded and parsed the pdb file, and stored it in thing.json. For windows, the file then has to be named specifically, so you'd need to put it in Also, I'm happy to answer questions, but I'd prefer to do it on our slack channel (@ikelos) rather than through our bug tracker. It'll just add noise to actual issues that need fixing if we carry out discussions here... |
It doesn't look like there's much more progress to be made on this, although we have now made the exceptions hopefully more helpful, so I'm going to close it. As always, please feel free to reopen it if you think it's been closed in error or there's still more that could be done... 5:) |
C:\volatility3-master>python vol.py -f test.raw windows.info
Volatility 3 Framework 1.0.0-beta.1
Progress: 99.99 Scanning memory_layer using PdbSignatureScanner
Unsatisfied requirement plugins.Info.nt_symbols: Windows kernel symbols
A symbol table requirement was not fulfilled. Please verify that:
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner
Unable to validate the plugin requirements: ['plugins.Info.nt_symbols']
I have downloaded the windows symbols folder, and as instructed placed it in the symbols folder (both zipped & unzipped). The image was taken using
winpmem -f raw -o test.raw
The text was updated successfully, but these errors were encountered: