volatility
volatility copied to clipboard
Windows 10 x64 pslist not showing anything
I am working on a Windows 10 ram dump i collected using Dumpit. I am using the Win10x64_18362 profile.
Context Volatility Version: 2.6.1 Operating System: Windows 10 Python Version: 2.7.17 Suspected Operating System: Windows 10 Command: >python vol.py --profile=Win10x64_18362 -f .\RAM_DUMPS\LAPTOP-H0DUE8GA-20200602-205807.raw pslist --kdbg=0xf805340a2744
OUTPUT
Volatility Foundation Volatility Framework 2.6.1
Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0xffffb0013b4c7280 ? 32...1 35...1 14...3 -------- ------ 1
KDBGSCAN
C:\Users\hitma\Downloads\volatility-master>python vol.py kdbgscan -f .\RAM_DUMPS\LAPTOP-H0DUE8GA-20200602-205807.raw
Volatility Foundation Volatility Framework 2.6.1
**************************************************
Instantiating KDBG using: Unnamed AS Win10x64_18362 (6.4.18362 64bit)
Offset (V) : 0xf805342265e0
Offset (P) : 0x30265e0
KdCopyDataBlock (V) : 0xf805340a2744
Block encoded : Yes
Wait never : 0x8e73886401d05e7f
Wait always : 0x3a0bd3265711d800
KDBG owner tag check : True
Profile suggestion (KDBGHeader): Win10x64_18362
Version64 : 0xf8053422a3d8 (Major: 15, Minor: 18362)
Service Pack (CmNtCSDVersion) : 0
Build string (NtBuildLab) : 18362.1.amd64fre.19h1_release.19
PsActiveProcessHead : 0xfffff80534238b60 (1 processes)
PsLoadedModuleList : 0xfffff80534248170 (1 modules)
KernelBase : 0xfffff80533e00000 (Matches MZ: True)
Major (OptionalHeader) : 10
Minor (OptionalHeader) : 0
KPCR : 0xfffff8052e10a000 (CPU 0)
KPCR : 0xffff9a00f6b62000 (CPU 1)
KPCR : 0xffff9a00f65e1000 (CPU 2)
KPCR : 0xffff9a00f6911000 (CPU 3)
KPCR : 0xffff9a00f6c8a000 (CPU 4)
KPCR : 0xffff9a00f6d39000 (CPU 5)
KPCR : 0xffff9a00f6dd6000 (CPU 6)
KPCR : 0xffff9a00f6e80000 (CPU 7)
Did you let kdbgscan run to completion or did you stop it after the first result? If you stopped it then please re-run and wait for full output and then copy/paste it all.