Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue TypeError: unsupported operand type(s) for ^: 'int' and 'NoneType' #656

Closed
Batman781 opened this issue Oct 26, 2019 · 1 comment
Closed

Comments

@Batman781
Copy link

Batman781 commented Oct 26, 2019

With a memory dump froma ESX6.7 snapshot of 2 GB RAM Windows 10 x64 version 18362, I'm getting following error:

[root@localhost volatility]# python vol.py -f /opt/dumps/Win10Untrusted-Snapshot14.vmem --profile=Win10x64_18362 psscan
Volatility Foundation Volatility Framework 2.6.1
Offset(P)          Name                PID   PPID PDB                Time created                   Time exited
------------------ ---------------- ------ ------ ------------------ ------------------------------ ------------------------------
WARNING : volatility.debug    : Cannot find nt!ObGetObjectType
WARNING : volatility.debug    : Cannot find nt!ObGetObjectType
Traceback (most recent call last):
  File "vol.py", line 192, in <module>
    main()
  File "vol.py", line 183, in main
    command.execute()
  File "/opt/volatility/volatility/commands.py", line 147, in execute
    func(outfd, data)
  File "/opt/volatility/volatility/plugins/filescan.py", line 428, in render_text
    for eprocess in data:
  File "/opt/volatility/volatility/poolscan.py", line 252, in scan
    skip_type_check = skip_type_check)
  File "/opt/volatility/volatility/plugins/overlays/windows/windows.py", line 1258, in get_object
    return self.get_object_top_down(struct_name, object_type, skip_type_check)
  File "/opt/volatility/volatility/plugins/overlays/windows/windows.py", line 1231, in get_object_top_down
    header.get_object_type() == object_type):
  File "/opt/volatility/volatility/plugins/overlays/windows/win7.py", line 155, in get_object_type
    return self.type_map.get(int(self.TypeIndex), '')
  File "/opt/volatility/volatility/plugins/overlays/windows/win10.py", line 330, in TypeIndex
    return ((addr >> 8) ^ cook ^ indx) & 0xFF
TypeError: unsupported operand type(s) for ^: 'int' and 'NoneType'
@gleeda
Copy link
Member

gleeda commented May 7, 2020

this is duplicate of issue #436

@gleeda gleeda closed this as completed May 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants