search

volatilityfoundation / volatility

An advanced memory forensics framework
http://volatilityfoundation.org/
GNU General Public License v2.0
7.04k stars 1.26k forks source link

no suitable address space mapping found #880

Open MaxFuwin opened 1 month ago

MaxFuwin commented 1 month ago

I was trying to obtain FVEK from my memory dump and I used a plugin named "bitlocker". so I ran the program with this plugin here is the result:

maxfuwin@maxfuwin-virtual-machine:~/Desktop/volatility$ sudo python2 vol.py -f aowtput.mem --profile Win10x64_19041 bitlocker [sudo] password for maxfuwin: Volatility Foundation Volatility Framework 2.6.1

Address Cipher FVEK TWEAK Key

No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64BitMap: No base Address Space VMWareMetaAddressSpace: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space QemuCoreDumpElf: No base Address Space VMWareAddressSpace: No base Address Space WindowsCrashDumpSpace32: No base Address Space SkipDuplicatesAMD64PagedMemory: No base Address Space WindowsAMD64PagedMemory: No base Address Space LinuxAMD64PagedMemory: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space OSXPmemELF: No base Address Space MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: No xpress signature found WindowsCrashDumpSpace64BitMap: Header signature invalid VMWareMetaAddressSpace: VMware metadata file is not available WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF Header signature invalid QemuCoreDumpElf: ELF Header signature invalid VMWareAddressSpace: Invalid VMware signature: 0xd8b4c813 WindowsCrashDumpSpace32: Header signature invalid SkipDuplicatesAMD64PagedMemory: Failed valid Address Space check WindowsAMD64PagedMemory: Failed valid Address Space check LinuxAMD64PagedMemory: Incompatible profile Win10x64_19041 selected AMD64PagedMemory: Failed valid Address Space check IA32PagedMemoryPae: Incompatible profile Win10x64_19041 selected IA32PagedMemory: Incompatible profile Win10x64_19041 selected OSXPmemELF: ELF Header signature invalid FileAddressSpace: Must be first Address Space ArmAddressSpace: Profile does not have valid Address Space check