search

ufrisk / MemProcFS

MemProcFS
GNU Affero General Public License v3.0
2.8k stars 352 forks source link

An issue with mounting image files #284

Closed gongyu0217 closed 2 months ago

gongyu0217 commented 2 months ago

MemProcFS>MemProcFS.exe -device ./memdump.dmp

### The following error occurred while executing the above code

[CORE] Initialization Failed. Unable to locate valid DTB. #2 VmmProc: Unable to auto-identify operating system. Specify PageDirectoryBase (DTB/CR3) in -dtb option if value if known. If arm64 dump, specify architecture: -arch arm64 [CORE] Failed to initialize.

ufrisk commented 2 months ago

MemProcFS is not able to analyze the dump for some reason. Is the dump valid? Are you able to open it with Volatility or WinDBG or may it be corrupt?

If it's indeed working in Volatility or WinDBG please let me know if you're able to share this dump. If it's a working memory dump I'm very keen on making it work on MemProcFS as well.

ufrisk commented 2 months ago

I'm closing this issue since I have not heard back on it. I assume it's resolved.