Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Volatility3 not work - symbol and pdbconv problem #1129

Open
Giak1234 opened this issue Apr 9, 2024 · 2 comments
Open

Volatility3 not work - symbol and pdbconv problem #1129

Giak1234 opened this issue Apr 9, 2024 · 2 comments

Comments

@Giak1234
Copy link

Giak1234 commented Apr 9, 2024

Good morning,
I am trying to run volatility3 on my PC but I am getting problems as per the picture:
1
I am also trying to convert the file ntkrnlmp.pdb to JSON with pdbconv.py (*\volatility3-develop\volatility3\framework\symbols\windows\pdbconv. py) to add it to the \volatility3-develop\volatility3\symbols\windows\ntkrnlmp.pdb folder but running the command "python3 pdbconv.py -f krnlmp.pdb -o c:\pdb" I do not get the desired JSON. How can I generate the conversion? Could you please provide support?
Thank you in advance.
PS: I followed this guide "https://medium.com/insomniacs/volatility-3-downloading-windows-symbols-for-volatility-3-on-air-gapped-machines-7bf7a63521c7".

@Giak1234
Copy link
Author

Giak1234 commented Apr 9, 2024

With REMnux is the same:
2

@ikelos
Copy link
Member

ikelos commented Apr 9, 2024

So the two outputs you've listed suggest it's trying to download the PDB file, but failing. Please could you post the output of trying to run python3 pdbconv.py -f krnlmp.pdb -o c:\pdb that you mentioned? You'll need to have volatility3 installed on the system somewhere, if you're not using the PYTHONPATH environment variable to tell it where the local installation is. It also looks like you provided a directory name, rather than the name of a file to the -o output parameter. Please try something like -o C:\pdb.json, or just leave out the -o parameter and it should display to the screen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants