pypykatz-volatility3 icon indicating copy to clipboard operation
pypykatz-volatility3 copied to clipboard

Error "KeyError: 'primary'" during work of plugin

Open Wowhere opened this issue 9 months ago • 1 comments

Hello, i need help.

When i use plugin, i got strange error: "KeyError: 'primary'"

Running command as python3 vol.py -f ~/testy-tms/silver.raw windows.vol_pypykatz.pypykatz

Got error:

Volatility 3 Framework 2.7.0 Traceback (most recent call last):B scanning finished
File "/home/andy/2/volatility3/volatility3/framework/interfaces/configuration.py", line 163, in getitem return self._data[key] ~~~~~~~~~~^^^^^ KeyError: 'primary'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/home/andy/2/volatility3/vol.py", line 10, in volatility3.cli.main() File "/home/andy/2/volatility3/volatility3/cli/init.py", line 871, in main CommandLine().run() File "/home/andy/2/volatility3/volatility3/cli/init.py", line 466, in run grid = constructed.run() ^^^^^^^^^^^^^^^^^ File "/home/andy/2/volatility3/volatility3/plugins/windows/vol_pypykatz.py", line 54, in run return pparser.go_volatility3(self, framework_version) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/andy/.local/lib/python3.11/site-packages/pypykatz/pypykatz.py", line 218, in go_volatility3 reader = Vol3Reader(vol3_obj) ^^^^^^^^^^^^^^^^^^^^ File "/home/andy/.local/lib/python3.11/site-packages/pypykatz/commons/readers/volatility3/volreader.py", line 66, in init self.setup() File "/home/andy/.local/lib/python3.11/site-packages/pypykatz/commons/readers/volatility3/volreader.py", line 69, in setup self.find_lsass() File "/home/andy/.local/lib/python3.11/site-packages/pypykatz/commons/readers/volatility3/volreader.py", line 88, in find_lsass layer_name = self.vol_obj.config['primary'], ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^ File "/home/andy/2/volatility3/volatility3/framework/interfaces/configuration.py", line 165, in getitem raise KeyError(key) KeyError: 'primary'

I dont have such error for other plugins. Seems like a bug in plugin (using 10.05.2024 version of volatility3)

Wowhere avatar May 09 '24 22:05 Wowhere