VolExplorer not working with Volatility2

[asterictnl-lvdw]

No handlers could be found for logger "volatility.debug" GL & HF <3 ATZ

Traceback (most recent call last): File ".\volexp.py", line 15211, in main() File ".\volexp.py", line 15203, in main my_ve.render_text(None, ve_calc, root) File ".\volexp.py", line 13562, in render_text for process, pid, ppid, cpu, pb, ws, Description, cn, dep, aslr, cfg, protection, isDebug, Prefetch, threads, handles, un, session, noh, sc, pfc, di, it, cs, winStatus, integrity, priority, ct, cycles, wsp, ppd, pwss, vs, pvs, createT, intName, ofn, wt, cl, path, cd, version, e_proc in data: File ".\volexp.py", line 13471, in calculate if int(self.kaddr_space.profile.metadata.get('major')) > 5 and int(self.kaddr_space.profile.metadata.get('minor')) > 1 and e_proc.Protection.Type > 0: #e_proc.Protection.Type==1: PsProtectionSingUntyMalwareLight, if 2 then is stronget and if 0 then no protection:###e_proc.Flag2&0x800 6.0-6.1#find protected process # _proc.Protection.Type==1: PsProtectionSingUntyMalwareLight, if 2 then is stronget and if 0 then no protection ###e_proc.Flag2&0x800 6.0-6.1and hasattr(e_proc, "Protection") File "C:\volatility\V2Exp\volatility\obj.py", line 751, in getattr return self.m(attr) File "C:\volatility\V2Exp\volatility\obj.py", line 733, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct _EPROCESS has no member Protection

Then the LoadScreen keeps looping and nothing happens.

~ LvdW

What I did is install the following packages: distorm3 yara pycrypto pillow openpyxl pytz ipython capstone ujson==1.35 tkkthemes

Let me know if I am doing something wrong.

I have tried with both the .exe and the normal .py to run it, same results.

[memoryforensics1]

That's volatility 2, right? I had an issue with that on specific windows version, I think I have the fix branch locally somewhere :/ What is the os version?

On Tue, Feb 21, 2023, 4:57 PM Leonardo van de Weteringh < @.***> wrote:

No handlers could be found for logger "volatility.debug" GL & HF <3 ATZ

Traceback (most recent call last): File ".\volexp.py", line 15211, in main() File ".\volexp.py", line 15203, in main my_ve.render_text(None, ve_calc, root) File ".\volexp.py", line 13562, in render_text for process, pid, ppid, cpu, pb, ws, Description, cn, dep, aslr, cfg, protection, isDebug, Prefetch, threads, handles, un, session, noh, sc, pfc, di, it, cs, winStatus, integrity, priority, ct, cycles, wsp, ppd, pwss, vs, pvs, createT, intName, ofn, wt, cl, path, cd, version, e_proc in data: File ".\volexp.py", line 13471, in calculate if int(self.kaddr_space.profile.metadata.get('major')) > 5 and int(self.kaddr_space.profile.metadata.get('minor')) > 1 and e_proc.Protection.Type > 0: #e_proc.Protection.Type==1: PsProtectionSingUntyMalwareLight, if 2 then is stronget and if 0 then no protection:###e_proc.Flag2&0x800 6.0-6.1#find protected process # _proc.Protection.Type==1: PsProtectionSingUntyMalwareLight, if 2 then is stronget and if 0 then no protection ###e_proc.Flag2&0x800 6.0-6.1and hasattr(e_proc, "Protection") File "C:\volatility\V2Exp\volatility\obj.py", line 751, in getattr return self.m(attr) File "C:\volatility\V2Exp\volatility\obj.py", line 733, in m raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr)) AttributeError: Struct _EPROCESS has no member Protection

Then the LoadScreen keeps looping and nothing happens.

~ LvdW

— Reply to this email directly, view it on GitHub https://github.com/memoryforensics1/VolExp/issues/1, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOWFQPMOUSLTUU64WVCQA2LWYTJT3ANCNFSM6AAAAAAVDE2KNM . You are receiving this because you are subscribed to this thread.Message ID: @.***>