search

volatilityfoundation / community

Volatility plugins developed and maintained by the community
340 stars 143 forks source link

AFF4 plugin not working 'PreStdLogicalImageContainer' object has no attribute 'image' #37

Closed ghost closed 4 years ago

ghost commented 4 years ago

Hi, im trying to use the AFF4 plugin to imageinfo a memory image. I've tried with a few others I have and the result is the same.

python vol.py --plugins=/fullpath/community/AFF4 -f /fullpath/image.aff4 imageinfo

DEBUG: volatility.debug : Trying <class 'volatility.plugins.aff4.AFF4AddressSpace'> DEBUG: volatility.debug : Failed instantiating (exception): 'PreStdLogicalImageContainer' object has no attribute 'image'

Result is no suggested profile, and No PAE.

Using pyaff4==0.27 as 0.33 fails to install. Installed all requirements that the plugin was complaining about initially. Are there any known good test images I can use to confirm it's not the image causing the problem? Running inside python2.7 virtualenv.

ghost commented 4 years ago

UPDATE: After extracting the Physical Memory stream from the aff4 using aff4imager, everything is working again.