You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With a memory dump froma ESX6.7 snapshot of 2 GB RAM Windows 10 x64 version 18362, I'm getting following error:
[root@localhost volatility]# python vol.py -f /opt/dumps/Win10Untrusted-Snapshot14.vmem --profile=Win10x64_18362 psscan
Volatility Foundation Volatility Framework 2.6.1
Offset(P) Name PID PPID PDB Time created Time exited
------------------ ---------------- ------ ------ ------------------ ------------------------------ ------------------------------
WARNING : volatility.debug : Cannot find nt!ObGetObjectType
WARNING : volatility.debug : Cannot find nt!ObGetObjectType
Traceback (most recent call last):
File "vol.py", line 192, in <module>
main()
File "vol.py", line 183, in main
command.execute()
File "/opt/volatility/volatility/commands.py", line 147, in execute
func(outfd, data)
File "/opt/volatility/volatility/plugins/filescan.py", line 428, in render_text
for eprocess in data:
File "/opt/volatility/volatility/poolscan.py", line 252, in scan
skip_type_check = skip_type_check)
File "/opt/volatility/volatility/plugins/overlays/windows/windows.py", line 1258, in get_object
return self.get_object_top_down(struct_name, object_type, skip_type_check)
File "/opt/volatility/volatility/plugins/overlays/windows/windows.py", line 1231, in get_object_top_down
header.get_object_type() == object_type):
File "/opt/volatility/volatility/plugins/overlays/windows/win7.py", line 155, in get_object_type
return self.type_map.get(int(self.TypeIndex), '')
File "/opt/volatility/volatility/plugins/overlays/windows/win10.py", line 330, in TypeIndex
return ((addr >> 8) ^ cook ^ indx) & 0xFF
TypeError: unsupported operand type(s) for ^: 'int' and 'NoneType'
The text was updated successfully, but these errors were encountered:
With a memory dump froma ESX6.7 snapshot of 2 GB RAM Windows 10 x64 version 18362, I'm getting following error:
The text was updated successfully, but these errors were encountered: