Pickling fails in obj.py, __getstate__, attribute error

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Create an object derived from obj.py:BaseObject
2. Pickle it
3. Observe errors

What is the expected output? What do you see instead?

I expected a pickled object. I got an exception instead.

Traceback (most recent call last):
  File "/home/user/PycharmProjects/volgoo/volgoo.py", line 100, in <module>
    win = create_proc_table(sm)
  File "/home/user/PycharmProjects/volgoo/volgoo.py", line 62, in create_proc_table
    gm = GenericModel(gt, sm.processes)
  File "/home/user/PycharmProjects/volgoo/sysman.py", line 29, in processes
    for source in self.processes_xview.values():
  File "/home/user/PycharmProjects/volgoo/sysman.py", line 19, in processes_xview
    self._ps_xview_dict = volproxy.psxview(self._config)
  File "/home/user/PycharmProjects/volgoo/volproxy.py", line 21, in psxview
    cPickle.dump(result, open(cache_file, 'wb'), cPickle.HIGHEST_PROTOCOL)
  File "/home/user/venv_vg/local/lib/python2.7/site-packages/volatility-2.3.1-py2.7.egg/volatility/obj.py", line 357, in __getstate__
    raise pickle.PicklingError("Object {0} at 0x{1:08x} cannot be cached because of missing attribute {2}".format(self.obj_name, self.obj_offset, arg))
cPickle.PicklingError: Object _EPROCESS at 0x858ef030 cannot be cached because 
of missing attribute kwargs

What version of the product are you using? On what operating system?

Vol 2.3.1 on Ubuntu x64 w/ Python 2.7

Please provide any additional information below.

I suspect this is because kwargs is in the init parameter list for BaseObject, 
but it isn't saved to an attribute on the object. Either preserve kwargs as an 
attribute on BaseObject or add it to the exceptions defined in __getstate__ 
(which already includes 'args').

Before:
 arg not in "self parent profile args".split()):

After:
 arg not in "self parent profile args kwargs".split()):

Original issue reported on code.google.com by dan...@raygoza.net on 21 May 2014 at 7:13

[GoogleCodeExporter]

Please try volatility 2.4, which you can find on github: 
https://github.com/volatilityfoundation/volatility

otherwise resubmit an issue at: 
https://github.com/volatilityfoundation/volatility/issues

Original comment by jamie.l...@gmail.com on 20 Nov 2014 at 8:25

• Changed state: Done