MemProcFS icon indicating copy to clipboard operation
MemProcFS copied to clipboard

Some Windows 7 memory images cannot analyze dst ip and dst port.

Open Tokeii0 opened this issue 10 months ago • 1 comments

============================== MemProcFS ==============================

  • Author: Ulf Frisk - [email protected]
  • Info: https://github.com/ufrisk/MemProcFS
  • License: GNU Affero General Public License v3.0

    MemProcFS is free open source software. If you find it useful please become a sponsor at: https://github.com/sponsors/ufrisk Thank You :)

  • Version: 5.8.9 (Windows)
  • Mount Point: M:\
  • Tag: 7601_b0806edb
  • Operating System: Windows 6.1.7601 (X64) ==========================================================================

[FORENSIC] FC_VIRTMEM_SCAN: INIT TOTAL: ranges=5193, bytes=df1c2000 [INFODB] INIT: SUCCESS: va=0xfffff880018f1000 [FORENSIC] FC_VIRTMEM_SCAN: FINISH [FORENSIC] INIT COMPLETED : time=4s

"M:\sys\net\netstat-v.txt" image

Tokeii0 avatar Apr 14 '24 14:04 Tokeii0

MemProcFS Windows 7 support isn't top notch unfortunately. I created this tool around 2018 and onwards and Windows 7 was never a big focus since it was quite old already by then.

I'll look into why this is missing though. Maybe there is something I can do about it.

Thanks for letting me know.

ufrisk avatar Apr 15 '24 15:04 ufrisk