Intermittent errors with linux plugins (~50% of memory acquisitions from the same machine have errors) #1534
Labels
Comments
|
Hello, Thank you for filing thia report! To start the feedback:
|
|
Passing pslist with -vvv |
|
Failing pslist with -vvv |
|
Thank you for the updated information. The pslist crash will be fixed by #1518 psaux will get its own pull request this week to fix it. I will close this ticket once both fixes are merged |
|
The second issue reported here with the |
|
Hello, We have validated with the latest dev branch and found that the pslist plugin is no longer crashing! Appreciate the updates that resolved this. However, now we are seeing some memory acquisitions that show ~75% less processes than a memory acquisition taken a minute earlier. We understand that the number of processes shown will fluctuate, but are curious: How can we validate that a memory capture is "complete" from a volatility3 perspective. We are running AVML and volatility3 as a part of automation, and would like to be able to evaluate memory acquisition completeness. For example, if a memory sample has 50% of the total processes in a smeared state that is unreadable by volatility3 plugins, we would want the automation to take a new capture. Is there a way to validate the amount of smearing or unreadable tasks detected in a pslist run? |
|
Are you comfortable with changing to previous commits instead of just branches? If so, for the samples losing that many processes (from pslist I assume), can you checkout the code base before this commit: And 1) see how many processes come back 2) if they actually look valid. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Started with post in community slack and was told to open issue here.
Example Errors (Full -vvv stacktraces included in comment)
python3.8 volatility3/vol.py -f output.lime linux.pslistpython3.8 volatility3/vol.py -f output.lime linux.psauxContext
To Reproduce
./avml output.limepython3.8 volatility3/vol.py -f output.lime linux.pslistNote on Reproducing
Expected behavior
Additional information
linux.ps_auxandlinux.pslistdoesn't cause errors inlinux.check_syscallThe text was updated successfully, but these errors were encountered: