Leor3961 / volatility

Automatically exported from code.google.com/p/volatility
0 stars 0 forks source link

Possible to suppress Memory Not Accessible messages? #38

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
Hey guys - not a defect here, more of a small inconvenience. A lot of the 
malware plugins inherit from procdump.ProcExeDump. When detecting API hooks, we 
have to rebuild all DLLs in a process, which results in thousands of these:

Memory Not Accessible: Virtual Address: 0x402000 File Offset: 0x1000 Size: 
0x1000
Memory Not Accessible: Virtual Address: 0x403000 File Offset: 0x1000 Size: 
0x1000
Memory Not Accessible: Virtual Address: 0x404000 File Offset: 0x1000 Size: 
0x1000
Memory Not Accessible: Virtual Address: 0x405000 File Offset: 0x1000 Size: 
0x1000

To see the output of the command, we have to do:

$ python volatility.py apihooks -f mem.dmp | egrep -v 'Memory Not Accessible'

Is there a way we can suppress the messages (or make them optional) so that the 
egrep isn't needed?

Thank you.

Original issue reported on code.google.com by michael.hale@gmail.com on 14 Oct 2010 at 9:37

GoogleCodeExporter commented 8 years ago
This issue was closed by revision r498.

Original comment by mike.auty@gmail.com on 14 Oct 2010 at 10:53

GoogleCodeExporter commented 8 years ago
Ok, all fixed.  To get these messages back, you'll need to specify --verbose.  
Note that section start alignment errors will still be reported irrespective of 
--verbose.  If you think these should also be hidden normally, please just add 
a note here.  5:)

Original comment by mike.auty@gmail.com on 14 Oct 2010 at 10:55