search

volatilityfoundation / volatility

An advanced memory forensics framework
http://volatilityfoundation.org/
GNU General Public License v2.0
7.04k stars 1.26k forks source link

Volatlity 2 Windows and Wintree Plugin Empty Output #833

Open BHamm-SE opened 1 year ago

BHamm-SE commented 1 year ago

Hello, I am having trouble running the windows and wintree plugin in Volatility 2.6 ( installed from http://downloads.volatilityfoundation.org/releases/2.6/volatility_2.6_lin64_standalone.zip). When I try to run either one of the plugins, nothing is returned. I know there are windows present in RAM due the output from the plugins deskscan and screenshot. See sample output below

vol2.py -f myMem.dd --profile=Win7SP1x86 deskscan Output snippet

Desktop: 0xbf5f1180, Name: WinSta0\Default, Next: 0x855e3188 SessionId: 0, DesktopInfo: 0xfe800578, fsHooks: 32 spwnd: 0xfe800618, Windows: 9 Heap: 0xfe800000, Size: 0xc00000, Base: 0xfe800000, Limit: 0xff400000 1216 (spoolsv.exe 1212 parent 408) 388 (csrss.exe 272 parent 264) 380 (csrss.exe 272 parent 264) 312 (wininit.exe 308 parent 264)

vol2.py -f myMem.dd --profile=Win7SP1x86 screenshot -D ./screenshots/ Output snippet (one image) session_1 WinSta0 Default

Empty Output from Windows and Wintree Plugins vol2.py -f myMem.dd --profile=Win7SP1x86 windows Output

Volatility Foundation Volatility Framework 2.6

vol2.py -f myMem.dd --profile=Win7SP1x86 wintree

Volatility Foundation Volatility Framework 2.6

I wasn't certain which windows 7 profile to use, but I tried all three that are available for x86, which includes Win7SP0x86, Win7SP1x86, Win7SP1x86_23418, and they all had the same output. Am I missing an argument when using these plugins or it is something else? Also, are there plugin equivalents in Volatility 3 for windows and wintree? Any help would be greatly appreciated. Thank you!