Volatility3 not work - symbol and pdb problem

[ysl2000]

Describe the bug
A few days ago volatility3 worked fine, today I try even the basic pslist command won't work.

Context
Volatility Version: Volatility 3 Framework 2.5.2
Operating System: win10
Python Version: 3.11

[ysl2000]

I want to know how to solve this problem. Please give the solution steps.

[ikelos]

Please ensure you include the output of volatility run with -vvv as mentioned in the instructions when filing a bug...

[ysl2000]

Please ensure you include the output of volatility run with -vvv as mentioned in the instructions when filing a bug...

Sorry, I don't understand what you mean. Is that right?

[ikelos]

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

[ysl2000]

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

Thank you for your advice. Also, I have vmss files in my folder. Now there are the following problems, how to solve them?

[ysl2000]

No, sorry, the -vvv must go directly after vol.py, so python vol.py -vvv -f "F:\Virtual Machines\Win 10\Windows 10 x64-da1a05fb.vmem" windows.pslist.PsList.

Please also note, that to use vmem files, you might also need a vmsn or vmss file to be present in the same directory for the memory image to be read correctly (these are metadata files used by vmware to store the memory more compactly, but volatility cannot tell whether vmware used these additional files or not).

In addition, it was able to run normally a few days ago, but suddenly there was a problem these days.

[nallamuthu]

@ysl2000 did you cloned the recent version and end up with this issue? I am also facing the same. It was working 25 days back but now i end up with same issue.

[ysl2000]

@ysl2000 did you cloned the recent version and end up with this issue? I am also facing the same. It was working 25 days back but now i end up with same issue.
Yes, I do! I changed the path of the entire file, copied it to another location, and then it didn't work. How can I solve it?

[Abyss-W4tcher]

Hi, could you try running --clear-cache right after the -vvv option ?

[ysl2000]

Hi, could you try running --clear-cache right after the -vvv option ?

Still not working.

[ikelos]

By supplying screenshots rather than copying the text of the output, it makes it very difficult to search and to copy/paste particular text from the output. When reporting bugs in the future, please always copy and paste text and do not include screenshots of text, it slows everything down.

There may be an issue with clearing the cache, in which case --clear-cache may also not solve the problem. To verify whether thats the case, please use --clear-cache and let us know whether that helps. If it doesn't, you'll need to delete the entire directory C:\Users\ysl.PC-20231112KYCE.000\AppData\Roaming\volatility3 (which may have a mistake because it retyped from the image, rather than copy pasting from the output). If you need to do that, please also report back whether that then solves the problem, and if so we can improve the --clear-cache function. Thanks...

[ysl2000]

By supplying screenshots rather than copying the text of the output, it makes it very difficult to search and to copy/paste particular text from the output. When reporting bugs in the future, please always copy and paste text and do not include screenshots of text, it slows everything down.

There may be an issue with clearing the cache, in which case --clear-cache may also not solve the problem. To verify whether thats the case, please use --clear-cache and let us know whether that helps. If it doesn't, you'll need to delete the entire directory C:\Users\ysl.PC-20231112KYCE.000\AppData\Roaming\volatility3 (which may have a mistake because it retyped from the image, rather than copy pasting from the output). If you need to do that, please also report back whether that then solves the problem, and if so we can improve the --clear-cache function. Thanks...

Sorry, using --clear-cache doesn't work either. And I did not find the path file you mentioned in drive C.

[ikelos]

The AppData directory is usually hidden, but I've made an update to ensure the cache is fully cleared during run, rather than the quick clear it does at the moment. Please ensure you're using commit 35c58372 and try the --clear-cache option again.

[ysl2000]

The AppData directory is usually hidden, but I've made an update to ensure the cache is fully cleared during run, rather than the quick clear it does at the moment. Please ensure you're using commit 35c58372 and try the --clear-cache option again.
I'm sorry, but the solution you proposed still doesn't solve the problem. Or is there something wrong with my orders? Could you please help me guide it again?

[ikelos]

From the name of the directory, it looks like you're using Volatility 2.5.0. You'd need to download the version from git after the commit I mentioned to get the update I made, or find the hidden AppData directory and remove just the volatility3 directory, again mentioned previously.

…

On Sun, 5 May 2024, 13:22 ysl2000, ***@***.***> wrote: The AppData directory is usually hidden, but I've made an update to ensure the cache is fully cleared during run, rather than the quick clear it does at the moment. Please ensure you're using commit 35c5837 and try the --clear-cache option again. I'm sorry, but the solution you proposed still doesn't solve the problem. Or is there something wrong with my orders? Could you please help me guide it again? ee5220a50bbb1e9ce2312349812407e.png (view on web) <https://github.com/volatilityfoundation/volatility3/assets/130417861/4049695f-0a89-419c-859a-15506491187c> — Reply to this email directly, view it on GitHub <#1136 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIZVMPYZ73UQ7SHH3JKXTZAYQCBAVCNFSM6AAAAABGW6ZUXCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJUG44DMNJVGM> . You are receiving this because you commented.Message ID: ***@***.***>

[ysl2000]

commit 35c5837

Thank you for your guidance. I don't know how to use commit 35c5837, but I re-downloaded volatility after your update. Although version 2.5.0 is still not working, version 2.7.0 is available.

[ikelos]

It's in the live development version. You can either wait for our next release or you can click on the green code button on the front page of our github site, and click download to get the latest development version. We need to roll a new release soon, but we haven't determined a date for that yet.

[ysl2000]

It's in the live development version. You can either wait for our next release or you can click on the green code button on the front page of our github site, and click download to get the latest development version. We need to roll a new release soon, but we haven't determined a date for that yet.

Okay, thank you.

[tury325re]

I think I found the fix here. I disabled Virtualization in my BIOS and re-generated the memory dump and bam, this error went away and I was able to have full functionality of Volatility. Let me know if that helps.

[ikelos]

This is an identical response to the one you posted to both #1223 and #1139. I don't believe that turning off intel VT-d support will help with all symbol/pdb problems, and this has essentially already been resolved as of commit 35c5837.

[tury325re]

I had the same exact symbol/pdb problem and disabling Virtualization in bios prior before generating the memory dump fixed my issue. Of course, i can't speak on if this will work for others