RuntimeError: Unable to find a valid profile for this image. Try using -v for more details.

WithSecureLabs / physmem2profit

Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely

Apache License 2.0

397 stars 72 forks source link

Open ctr1hub opened 3 years ago

ctr1hub commented 3 years ago

timhir commented 3 years ago

If you take a full physical memory dump from the system, is Rekall able to analyze it correctly? What about Volatility 3?

Rekall has been discontinued after Physmem2profit was released so I need to start using Volatility 3 anyway. I'm hoping that will fix this issue.

Fr0gZero commented 8 months ago

Any update on using volatility3?

I am trying to find a minidump creation module for lsass but maybe my google fu is not up to snuff.

If you happen to have any resources or one liners on how to create a minidump even from an offloaded physical memory file that would be great.

PS this project is awesome