search

skelsec / pypykatz-volatility3

pypykatz plugin for volatility3 framework
MIT License
31 stars 14 forks source link

help me,thanks #6

Open xiaozimo20 opened 1 year ago

xiaozimo20 commented 1 year ago

python3 vol.py -f OtterCTF.vmem -p ../pypykatz pypykatz Volatility 3 Framework 2.4.2 Progress: 100.00 PDB scanning finished

Volatility was unable to read a requested page: Page error 0x7f0 in layer primary_Process500 (Page Fault at entry 0x0 in page entry)

    * Memory smear during acquisition (try re-acquiring if possible)
    * An intentionally invalid page lookup (operating system protection)
    * A bug in the plugin/volatility3 (re-run with -vvv and file a bug)

No further results will be produced

skelsec commented 1 year ago

try using memprocfs instead of volatility, that will produce you a .dmp file which you can load to pypykatz. But in general, full memory dumps might not always produce correct results because of memory smearing. In that case you might need to re-do the memory acquisition.