Progress percent of the forensics mode stucks at 90% and not finishing

UltraForensic commented 4 months ago

Hello, I ran into an issue that forensics mode (-forensic 1) stucks since its forensic/progress_percent.txt reaches 90 in specific memory image.

> MemProcFS.exe -device physmem.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys -forensic 1 -license-accept-elastic-license-2-0
Initialized 64-bit Windows 10.0.22631
[PLUGIN]   Python initialization failed. Python 3.6 or later not found.

==============================  MemProcFS  ==============================
 - Author:           Ulf Frisk - pcileech@frizk.net
 - Info:             https://github.com/ufrisk/MemProcFS
 - Discord:          https://discord.gg/pcileech
 - License:          GNU Affero General Public License v3.0
   ---------------------------------------------------------------------
   MemProcFS is free open source software. If you find it useful please
   become a sponsor at: https://github.com/sponsors/ufrisk Thank You :)
   ---------------------------------------------------------------------
 - Version:          5.11.1 (Windows)
 - Mount Point:      M:\
 - Tag:              22631_c82dd926
 - Operating System: Windows 10.0.22631 (X64)
==========================================================================

PS M:\> date

Monday, July 29, 2024 11:06:33 PM

PS M:\> type .\forensic\progress_percent.txt
90
PS M:\> date

Monday, July 29, 2024 11:49:36 PM

PS M:\> type .\forensic\progress_percent.txt
90
PS M:\> dir .\forensic\

    Directory: M:\forensic

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
------         7/29/2024  11:01 PM              2 progress_percent.txt
------         7/29/2024  11:01 PM              1 forensic_enable.txt
------         7/29/2024  11:01 PM              0 database.txt
------         7/29/2024  11:01 PM           2695 readme.txt

Confirmed that this issue is still present on latest release version of MemProcFS (5.11.1) for Windows.

Let me know if any additional information is needed for investigation (I can share the memory image causing this issue). Thanks for developing a great tool!

Some notes:

Memory image has been acquired using WinPmem (Release 4.0 RC2)
- https://github.com/Velocidex/WinPmem/releases/tag/v4.0.rc1
- winpmem_mini_x64_rc2.exe physmem.raw
Machine running MemProcFS and origin of acquired memory image is both Windows 11 23H2 on VMware Workstation 17 Pro 17.5.2

ufrisk commented 4 months ago

There must be some deadlock issue. Those can be a bit tricky to find, but it's good that you're able to share the memory dump.

Can you please zip and upload the memory dump, pagefile and swapfile and share the link with me and I'll take a look ASAP.

Send it to me in a DM on Twitter or Discord

UltraForensic commented 4 months ago

@ufrisk Thank you for quick reply! Sent you a DM on Twitter. Please check it out.

ufrisk commented 4 months ago

The issue should now be resolved in 5.11.2 which was just published.

It was a parsing issue resulting the parser to get stuck in a forever loop in some very specific cases.

Thank you for reporting this issue and sharing the problematic memory dump.

ufrisk / MemProcFS

Progress percent of the forensics mode stucks at 90% and not finishing #305