Open srvlocalr00t opened 3 months ago
Hello.
I ported the TrueCrypt cached passphrase finder from Volatility2 to Volatility3.
This error message occurs when the number of bytes in the data section isn't a multiple of DWORD_SIZE_BYTES
(which is 4).
Volatility2's cached passphrase finder, running Python 2.6 ≤ x < 3, doesn't check for this alignment and instead iterates over the available DWORD_SIZE_BYTES
-sized chunks, as evidenced by the relevant section of code in Volatility2's tcaudit.py
# Looking for the Length member, DWORD-aligned
ints = obj.Object("Array", targetType = "int",
offset = base, count = size / 4,
vm = addr_space)
which uses the integer quotient of size
over 4.
I was unsure if this was intentional behaviour so I opted to raise an error when the situation arose.
If anybody else has further insight into the matter and can explain why the error message shouldn't be raised then I'm happy to propose a pull request with the necessary changes.
Otherwise, if you'd like to mimic Volatility2's behaviour, you can modify the following lines in volatility3\framework\plugins\windows\truecrypt.py
count, not_aligned = divmod(size, DWORD_SIZE_BYTES)
if not_aligned:
raise ValueError("PE data section not DWORD-aligned!")
to
count = size // DWORD_SIZE_BYTES
You could check if the excess bytes are always 00
and therefore suggests it's padding? If there's a total length field being used, that might also make sense?
Sorry, my comment was aimed at @iyassou
Hello.
I ported the TrueCrypt cached passphrase finder from Volatility2 to Volatility3.
This error message occurs when the number of bytes in the data section isn't a multiple of
DWORD_SIZE_BYTES
(which is 4).Volatility2's cached passphrase finder, running Python 2.6 ≤ x < 3, doesn't check for this alignment and instead iterates over the available
DWORD_SIZE_BYTES
-sized chunks, as evidenced by the relevant section of code in Volatility2's tcaudit.py# Looking for the Length member, DWORD-aligned ints = obj.Object("Array", targetType = "int", offset = base, count = size / 4, vm = addr_space)
which uses the integer quotient of
size
over 4.I was unsure if this was intentional behaviour so I opted to raise an error when the situation arose.
If anybody else has further insight into the matter and can explain why the error message shouldn't be raised then I'm happy to propose a pull request with the necessary changes.
Otherwise, if you'd like to mimic Volatility2's behaviour, you can modify the following lines in
volatility3\framework\plugins\windows\truecrypt.py
count, not_aligned = divmod(size, DWORD_SIZE_BYTES) if not_aligned: raise ValueError("PE data section not DWORD-aligned!")
to
count = size // DWORD_SIZE_BYTES
Hello @iyassou it's dumped file of Win11 that’s Vol2 is no use for me. I’m playing CTF challenge. If you want dump I can provide. Do you know any manual method to extract the key?
could help me with exact proper code.
I tried with 0,1,2 in Dword size byte that time it's show me blank result without error.
when I tried with 3,4++++ showing this dword error.
thanks
Hello.
I ported the TrueCrypt cached passphrase finder from Volatility2 to Volatility3.
This error message occurs when the number of bytes in the data section isn't a multiple of
DWORD_SIZE_BYTES
(which is 4).Volatility2's cached passphrase finder, running Python 2.6 ≤ x < 3, doesn't check for this alignment and instead iterates over the available
DWORD_SIZE_BYTES
-sized chunks, as evidenced by the relevant section of code in Volatility2's tcaudit.py# Looking for the Length member, DWORD-aligned ints = obj.Object("Array", targetType = "int", offset = base, count = size / 4, vm = addr_space)
which uses the integer quotient of
size
over 4.I was unsure if this was intentional behaviour so I opted to raise an error when the situation arose.
If anybody else has further insight into the matter and can explain why the error message shouldn't be raised then I'm happy to propose a pull request with the necessary changes.
Otherwise, if you'd like to mimic Volatility2's behaviour, you can modify the following lines in
volatility3\framework\plugins\windows\truecrypt.py
count, not_aligned = divmod(size, DWORD_SIZE_BYTES) if not_aligned: raise ValueError("PE data section not DWORD-aligned!")
to
count = size // DWORD_SIZE_BYTES
I tried what you suggested.... it;s showing blank output. error is stopped
Be aware that truecrpyt doesn't always cache a password, it may only be the master keys held in memory. (Although the fact the plugin tried might mean that there is a password)
Do you have any idea to solve or retrieve it manually?
This blog post is a good place to start: https://volatility-labs.blogspot.com/2014/01/truecrypt-master-key-extraction-and.html
Offset Length Password Traceback (most recent call last): File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\vol.py", line 10, in
volatility3.cli.main()
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\cli__init.py", line 871, in main
CommandLine().run()
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\cli__init__.py", line 469, in run
renderer.render(grid)
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\cli\text_renderer.py", line 198, in render
grid.populate(visitor, outfd)
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\framework\renderers\init__.py", line 245, in populate
for level, item in self._generator:
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\framework\plugins\windows\truecrypt.py", line 131, in _generator
for offset, password in self.scan_module(
File "C:\Users\srv\Downloads\volatility3-develop\volatility3-develop\volatility3\framework\plugins\windows\truecrypt.py", line 83, in scan_module
raise ValueError("PE data section not DWORD-aligned!")
ValueError: PE data section not DWORD-aligned!