Volatility Framework 3.0.0_alpha1
Level 7  root        : Cache directory used: /home/mike/.cache/volatility3
INFO     root        : Detected a windows category plugin
INFO     root        : Restricting automagics to: ['ConstructionMagic', 'LayerStacker', 'WinSwapLayers', 'NlpDtbfinder', 'WintelHelper', 'KernelPDBScanner']
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo.nt_symbols
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - address requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - address requirements only accept int type: None
INFO     volatility.framework.automagic: Running automagic: LayerStacker
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 7  volatility.framework.layers: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic
Progress:    0.00		Scanning FileLayer1 using PageMapScannerDEBUG    volatility.framework.automagic.windows: DTB was found at: 0x1a8000
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['IntelLayer1', 'LimeLayer1', 'FileLayer1']
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary.memory_layer
Level 9  volatility.framework.interfaces.configuration: IndexError - No configuration provided: plugins.VadInfo.primary.memory_layer.base_layer
Level 7  volatility.framework.layers: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - linux_banner requirements only accept str type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - linux_banner requirements only accept str type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo.nt_symbols
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.VadInfo
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - address requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - address requirements only accept int type: None
INFO     volatility.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility.framework.automagic: Running automagic: NlpDtbfinder
INFO     volatility.framework.automagic: Running automagic: WintelHelper
INFO     volatility.framework.automagic: Running automagic: KernelPDBScanner
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
Level 9  volatility.framework.interfaces.configuration: TypeError - SymbolRequirement only accepts string labels: None
DEBUG    volatility.framework.automagic.pdbscan: Potential kernel_virtual_offset caused a page fault: 0x8204f000
DEBUG    volatility.framework.automagic.pdbscan: Potential kernel_virtual_offset caused a page fault: 0x8261b000
DEBUG    volatility.framework.automagic.pdbscan: Potential kernel_virtual_offset caused a page fault: 0x86b1a000
DEBUG    volatility.framework.automagic.pdbscan: Kernel base randomized, searching layer for base address offset
Progress:   94.21		Scanning primary2 using PdbSignatureScannerDEBUG    volatility.framework.automagic.pdbscan: Using symbol library: ntkrpamp.pdb/9619274AA03341AFACF0F40A6DFACA90-1
Level 7  volatility.framework.layers: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
INFO     volatility.framework.layers: Caching file at: /home/mike/.cache/volatility3/data_f85dd5f219d0840d156aeef1efda091743b2d03881573e2eea14fa9572772f54efad5ddb45881fde4781669e0c1337a369d599321c293116478199ab0a96d1b5
DEBUG    volatility.framework.automagic.pdbscan: Setting kernel_virtual_offset to 0x80e1b000



	PID	Process	Offset	Start VPN	End VPN	Tag	Protection	CommitCharge	PrivateMemory	Parent	File
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_EPROCESS_QUOTA_BLOCK
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_PAGEFAULT_HISTORY
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_JOB_ACCESS_STATE
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_JOB_CPU_RATE_CONTROL
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_JOB_NET_RATE_CONTROL
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_JOB_NOTIFICATION_INFORMATION
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_PSP_STORAGE
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_ACTIVATION_CONTEXT_DATA
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_FLS_CALLBACK_INFO
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_ASSEMBLY_STORAGE_MAP
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_WNF_SCOPE_MAP
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_ETW_SOFT_RESTART_CONTEXT
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_ETW_STACK_CACHE
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_ETW_PERFECT_HASH_FUNCTION
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_HAL_PMC_COUNTERS
DEBUG    volatility.framework.symbols: Unresolved reference: nt_symbols1!_SCSI_REQUEST_BLOCK
Traceback (most recent call last):
  File "vol.py", line 6, in <module>
    volatility.cli.main()
  File "/home/mike/workspace/volatility3/volatility/cli/__init__.py", line 315, in main
    CommandLine().run()
  File "/home/mike/workspace/volatility3/volatility/cli/__init__.py", line 211, in run
    text.QuickTextRenderer().render(constructed.run())
  File "/home/mike/workspace/volatility3/volatility/framework/renderers/text.py", line 73, in render
    grid.populate(visitor, outfd)
  File "/home/mike/workspace/volatility3/volatility/framework/renderers/__init__.py", line 184, in populate
    for (level, item) in self._generator:
  File "/home/mike/workspace/volatility3/volatility/plugins/windows/vadinfo.py", line 88, in _generator
    vad.get_private_memory(),
  File "/home/mike/workspace/volatility3/volatility/framework/symbols/windows/extensions/__init__.py", line 203, in get_private_memory
    return self.Core.u1.VadFlags1.PrivateMemory
  File "/home/mike/workspace/volatility3/volatility/framework/objects/__init__.py", line 607, in __getattr__
    raise AttributeError("Struct has no attribute: {}.{}".format(self.vol.type_name, attr))
AttributeError: Struct has no attribute: nt_symbols1!_MMVAD_FLAGS1.PrivateMemory

$ python vol.py -vvvvvv -f <path-to-macos-10-11-6-15G1217>/data.lime mac.pslist.PsList

Level 6  volatility.framework.automagic.stacker: Attempting to stack using MacintelStacker

> $ volatility3 -s volatility3-symbols -f win7sp1x64.dmp windows.statistics.Statistics
Volatility 3 Framework 1.0.0-beta.1
Progress:    0.00		Scanning FileLayer using PageMapScanner
Unsatisfied requirement plugins.Statistics.primary: Memory layer for the kernel

A translation layer requirement was not fulfilled.  Please verify that:
	A file was provided to create this layer (by -f, --single-location or by config)
	The file exists and is readable
	The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.Statistics.primary']

DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic

DEBUG    volatility.framework.automagic.windows: DTB was found at: 0x......

$ python3 vol.py -c config.json windows.pslist.PsList
Volatility Framework 3.0.0_alpha1
WARNING  volatility.framework.plugins: Automagic exception occured: ValueError: Unable to run LayerStacker, single_location parameter not provided
Unable to validate the plugin requirements: ['plugins.PsList.primary']

root@t1:/shared/volatility3# python3 /shared/volatility3/volatility/framework/symbols/windows/pdbconv.py -o /tmp --file /shared/windows10/ntkrnlmp.pdb 
  File "/shared/volatility3/volatility/framework/symbols/windows/pdbconv.py", line 988, in <module>
    convertor = PdbReader(ctx, location, progress_callback = pg_cb)
  File "/shared/volatility3/volatility/framework/symbols/windows/pdbconv.py", line 263, in __init__
    self._layer_name, self._context = self.load_pdb_layer(context, location)
  File "/shared/volatility3/volatility/framework/symbols/windows/pdbconv.py", line 309, in load_pdb_layer
    msf_layer = msf.PdbMultiStreamFormat(new_context, msf_config_path, msf_layer_name)
  File "/usr/local/lib/python3.7/dist-packages/volatility-1.0.0b1-py3.7.egg/volatility/framework/layers/msf.py", line 28, in __init__
    self._pdb_symbol_table = intermed.IntermediateSymbolTable.create(context, self._config_path, 'windows', 'pdb')
  File "/usr/local/lib/python3.7/dist-packages/volatility-1.0.0b1-py3.7.egg/volatility/framework/symbols/intermed.py", line 228, in create
    raise ValueError("No symbol files found at provided filename: {}", filename)
ValueError: ('No symbol files found at provided filename: {}', 'pdb')

INFO     volatility.framework.automagic: Detected a windows category plugin
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.nt_symbols
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
INFO     volatility.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility.framework.automagic: Running automagic: LayerStacker
DEBUG    volatility.framework: Importing module: volatility.framework.layers.lime
DEBUG    volatility.framework: Importing module: volatility.framework.layers.linear
DEBUG    volatility.framework: Importing module: volatility.framework.layers.resources
DEBUG    volatility.framework: Importing module: volatility.framework.layers.crash
DEBUG    volatility.framework: Importing module: volatility.framework.layers.registry
DEBUG    volatility.framework: Importing module: volatility.framework.layers.elf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.intel
DEBUG    volatility.framework: Importing module: volatility.framework.layers.msf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.segmented
DEBUG    volatility.framework: Importing module: volatility.framework.layers.vmware
DEBUG    volatility.framework: Importing module: volatility.framework.layers.physical
DEBUG    volatility.framework: Importing module: volatility.framework.layers.scanners.multiregexp
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
DEBUG    volatility.framework.automagic.windows: DTB was found at: 0x187000
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary.memory_layer
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary.memory_layer.base_layer
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.nt_symbols
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - pid requirements only accept int type: None
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'Elf64Layer', 'FileLayer']
INFO     volatility.framework.automagic: Running automagic: WintelHelper
INFO     volatility.framework.automagic: Running automagic: KernelPDBScanner
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
DEBUG    volatility.framework.automagic.pdbscan: Kernel base determination - using KDBG structure for kernel offset
INFO     volatility.framework.symbols.windows.pdbconv: Download PDB file...
DEBUG    volatility.framework.symbols.windows.pdbconv: Attempting to retrieve http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/4EC39E6D760F4A26A5192B89B2E0158E1/ntkrnlmp.pd_
DEBUG    volatility.framework.symbols.windows.pdbconv: Failed with HTTP Error 404: Not Found
DEBUG    volatility.framework.symbols.windows.pdbconv: Attempting to retrieve http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/4EC39E6D760F4A26A5192B89B2E0158E1/ntkrnlmp.pdb
DEBUG    volatility.framework.symbols.windows.pdbconv: Successfully written to /tmp/tmp10bx0m1k.pdb/4EC39E6D760F4A26A5192B89B2E0158E1/
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None2E0158E1/ntkrnlmp.pdb
WARNING  volatility.framework.plugins: Automagic exception occured: TypeError: __new__() missing 4 required positional arguments: 'type_name', 'object_info', 'base_type', and 'choices'
Level 9  volatility.framework.plugins: Traceback (most recent call last):
  File "/home/user/volatility3/volatility/framework/automagic/__init__.py", line 129, in run
    automagic(context, config_path, requirement, progress_callback)
  File "/home/user/volatility3/volatility/framework/automagic/pdbscan.py", line 479, in __call__
    self.recurse_symbol_fulfiller(context, valid_kernels, progress_callback)
  File "/home/user/volatility3/volatility/framework/automagic/pdbscan.py", line 209, in recurse_symbol_fulfiller
    self.download_pdb_isf(kernel['GUID'], kernel['age'], kernel['pdb_name'], progress_callback)
  File "/home/user/volatility3/volatility/framework/automagic/pdbscan.py", line 253, in download_pdb_isf
    json_output = pdbconv.PdbReader(self.context, location, progress_callback).get_json()
  File "/home/user/volatility3/volatility/framework/symbols/windows/pdbconv.py", line 263, in __init__
    self._layer_name, self._context = self.load_pdb_layer(context, location)
  File "/home/user/volatility3/volatility/framework/symbols/windows/pdbconv.py", line 299, in load_pdb_layer
    new_context = context.clone()
  File "/home/user/volatility3/volatility/framework/interfaces/context.py", line 94, in clone
    return copy.deepcopy(self)
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 280, in _reconstruct
    state = deepcopy(state, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 280, in _reconstruct
    state = deepcopy(state, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 280, in _reconstruct
    state = deepcopy(state, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 215, in _deepcopy_list
    append(deepcopy(a, memo))
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 220, in _deepcopy_tuple
    y = [deepcopy(a, memo) for a in x]
  File "/usr/lib/python3.7/copy.py", line 220, in <listcomp>
    y = [deepcopy(a, memo) for a in x]
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 274, in _reconstruct
    y = func(*args)
  File "/usr/lib/python3.7/copy.py", line 273, in <genexpr>
    args = (deepcopy(arg, memo) for arg in args)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 220, in _deepcopy_tuple
    y = [deepcopy(a, memo) for a in x]
  File "/usr/lib/python3.7/copy.py", line 220, in <listcomp>
    y = [deepcopy(a, memo) for a in x]
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 280, in _reconstruct
    state = deepcopy(state, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 280, in _reconstruct
    state = deepcopy(state, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 150, in deepcopy
    y = copier(x, memo)
  File "/usr/lib/python3.7/copy.py", line 240, in _deepcopy_dict
    y[deepcopy(key, memo)] = deepcopy(value, memo)
  File "/usr/lib/python3.7/copy.py", line 180, in deepcopy
    y = _reconstruct(x, memo, *rv)
  File "/usr/lib/python3.7/copy.py", line 274, in _reconstruct
    y = func(*args)
  File "/usr/lib/python3.7/copyreg.py", line 88, in __newobj__
    return cls.__new__(cls, *args)
TypeError: __new__() missing 4 required positional arguments: 'type_name', 'object_info', 'base_type', and 'choices'

Unsatisfied requirement plugins.PsList.nt_symbols: Windows kernel symbols

A symbol table requirement was not fulfilled.  Please verify that:
  You have the correct symbol file for the requirement
  The symbol file is under the correct directory or zip file
  The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.nt_symbols']

Kernel Base	0xf8054ccbd000
DTB	0x1ad000
Symbols	file:///Users/user/Downloads/volatility3/volatility/symbols/windows/ntkrnlmp.pdb/E0093F3AEF15D58168B753C9488A4043-1.json.xz
primary	0 WindowsIntel32e
memory_layer	1 FileLayer
KdVersionBlock	0xf8054d0e73c8
Major/Minor	15.18362
MachineType	34404
KeNumberProcessors	2
SystemTime	2019-11-13 16:52:07
NtSystemRoot	C:\Windows
NtProductType	NtProductWinNt
NtMajorVersion	10
NtMinorVersion	0
PE MajorOperatingSystemVersion	10
PE MinorOperatingSystemVersion	0
PE Machine	34404
PE TimeDateStamp	Mon Apr 14 21:36:50 2104

user-mbp:volatility3 user$ python3 vol.py -v -f ~/Desktop/Memory\ Images/VAE_CRT_RX.vmem windows.malfind.Malfind
Volatility 3 Framework 1.0.0-beta.1
INFO     root        : Volatility plugins path: ['/Users/user/Downloads/volatility3/volatility/plugins', '/Users/user/Downloads/volatility3/volatility/framework/plugins']
INFO     root        : Volatility symbols path: ['/Users/user/Downloads/volatility3/volatility/symbols', '/Users/user/Downloads/volatility3/volatility/framework/symbols']
INFO     volatility.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
INFO     volatility.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
INFO     volatility.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
INFO     volatility.plugins.yarascan: Python Yara module not found, plugin (and dependent plugins) not available
INFO     volatility.plugins.windows.verinfo: Python pefile module not found, plugin (and dependent plugins) not available
INFO     root        : The following plugins could not be loaded (use -vv to see why): volatility.plugins.windows.callbacks, volatility.plugins.windows.svcscan, volatility.plugins.windows.vadyarascan, volatility.plugins.windows.verinfo, volatility.plugins.yarascan
INFO     volatility.framework.automagic: Detected a windows category plugin
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
INFO     volatility.framework.automagic: Running automagic: LayerStacker
INFO     volatility.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility.framework.automagic: Running automagic: WintelHelper
INFO     volatility.framework.automagic: Running automagic: KernelPDBScanner
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema

PID	Process	Start VPN	End VPN	Tag	Protection	CommitCharge	PrivateMemory	Hexdump	Disasm
Traceback (most recent call last):
  File "vol.py", line 10, in <module>
    volatility.cli.main()
  File "/Users/user/Downloads/volatility3/volatility/cli/__init__.py", line 442, in main
    CommandLine().run()
  File "/Users/user/Downloads/volatility3/volatility/cli/__init__.py", line 269, in run
    renderers[args.renderer]().render(constructed.run())
  File "/Users/user/Downloads/volatility3/volatility/cli/text_renderer.py", line 160, in render
    grid.populate(visitor, outfd)
  File "/Users/user/Downloads/volatility3/volatility/framework/renderers/__init__.py", line 196, in populate
    for (level, item) in self._generator:
  File "/Users/user/Downloads/volatility3/volatility/framework/plugins/windows/malfind.py", line 115, in _generator
    for vad, data in self.list_injections(self.context, self.config["nt_symbols"], proc):
  File "/Users/user/Downloads/volatility3/volatility/framework/plugins/windows/malfind.py", line 92, in list_injections
    vadinfo.VadInfo.protect_values(context, proc_layer_name, symbol_table), vadinfo.winnt_protections)
  File "/Users/user/Downloads/volatility3/volatility/framework/symbols/windows/extensions/__init__.py", line 410, in get_protection
    protect = self.u.VadFlags.Protection
  File "/Users/user/Downloads/volatility3/volatility/framework/objects/__init__.py", line 689, in __getattr__
    raise AttributeError("{} has no attribute: {}.{}".format(agg_name, self.vol.type_name, attr))
AttributeError: StructType has no attribute: nt_symbols1!<anonymous-tag>.VadFlags

INFO     volatility.framework.automagic: Detected a windows category plugin
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.Statistics.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.Statistics
INFO     volatility.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility.framework.automagic: Running automagic: LayerStacker
DEBUG    volatility.framework: Importing module: volatility.framework.layers.lime
DEBUG    volatility.framework: Importing module: volatility.framework.layers.linear
DEBUG    volatility.framework: Importing module: volatility.framework.layers.resources
DEBUG    volatility.framework: Importing module: volatility.framework.layers.crash
DEBUG    volatility.framework: Importing module: volatility.framework.layers.registry
DEBUG    volatility.framework: Importing module: volatility.framework.layers.elf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.intel
DEBUG    volatility.framework: Importing module: volatility.framework.layers.msf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.segmented
DEBUG    volatility.framework: Importing module: volatility.framework.layers.vmware
DEBUG    volatility.framework: Importing module: volatility.framework.layers.physical
DEBUG    volatility.framework: Importing module: volatility.framework.layers.scanners.multiregexp
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
DEBUG    volatility.framework.automagic.windows: DTB was found at: 0x187000
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary.memory_layer
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.Statistics.primary.memory_layer.base_layer
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'Elf64Layer', 'FileLayer']
INFO     volatility.framework.automagic: Running automagic: WintelHelper
INFO     volatility.framework.automagic: Running automagic: KernelPDBScanner

Valid pages (all)	Valid pages (large)	Swapped Pages (all)	Swapped Pages (large)	Invalid Pages (all)	Invalid Pages (large)
Traceback (most recent call last):ading memory                         
  File "/home/user/vol3", line 11, in <module>
    load_entry_point('volatility', 'console_scripts', 'vol')()
  File "/home/user/volatility3/volatility/cli/__init__.py", line 442, in main
    CommandLine().run()
  File "/home/user/volatility3/volatility/cli/__init__.py", line 269, in run
    renderers[args.renderer]().render(constructed.run())
  File "/home/user/volatility3/volatility/cli/text_renderer.py", line 159, in render
    grid.populate(visitor, outfd)
  File "/home/user/volatility3/volatility/framework/renderers/__init__.py", line 196, in populate
    for (level, item) in self._generator:
  File "/home/user/volatility3/volatility/plugins/windows/statistics.py", line 33, in _generator
    _, _, page_size, layer_name = list(layer.mapping(page_addr, 0x2000))[0]
  File "/home/user/volatility3/volatility/framework/layers/intel.py", line 198, in mapping
    raise exceptions.InvalidAddressException(layer_name = layer_name, invalid_address = chunk_offset)
volatility.framework.exceptions.InvalidAddressException

Unsatisfied requirement plugins.PsList.primary: Memory layer for the kernel
Unsatisfied requirement plugins.PsList.darwin: Mac kernel symbols

A symbol table requirement was not fulfilled.  Please verify that:
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner


A translation layer requirement was not fulfilled.  Please verify that:
        A file was provided to create this layer (by -f, --single-location or by config)
        The file exists and is readable
        The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.PsList.primary', 'plugins.PsList.darwin']

Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 8  volatility.framework.automagic.stacker: Attempting to stack using Elf64Stacker
Level 6  volatility.framework.layers.elf: Exception: Bad magic 0x80000002 at file offset 0x0
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LimeStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WindowsCrashDump32Stacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using VmwareStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WintelStacker
DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic
Level 8  volatility.framework.automagic.stacker: Attempting to stack using MacintelStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LintelStacker
INFO     volatility.framework.automagic.linux: No Linux banners found - if this is a linux plugin, please check your symbol files location
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayer
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['FileLayer']
INFO     volatility.framework.automagic: Running automagic: MacSymbolFinder
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - SymbolTableRequirement only accepts string labels: None

vol.py -f X.dmp --profile=Win7SP1x86 yarascan -y X.yar
Volatility Foundation Volatility Framework 2.6.1
Rule: X
<removed>

python3 vol.py -vvvvvvv -f memdump.dmp yarascan.YaraScan --yara-file test.yar
Volatility 3 Framework 1.0.0-beta.1
INFO     root        : Volatility plugins path: ['/home/X/volatility3/volatility/plugins', '/home/X/volatility3/volatility/framework/plugins']
INFO     root        : Volatility symbols path: ['/home/X/volatility3/volatility/symbols', '/home/X/volatility3/volatility/framework/symbols']
Level 6  volatility.framework: Importing from the following paths: /home/X/volatility3/volatility/plugins, /home/X/volatility3/volatility/framework/plugins
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.statistics
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.registry.certificates
DEBUG    volatility.framework: Importing module: volatility.plugins.yarascan
DEBUG    volatility.framework: Importing module: volatility.plugins.layerwriter
DEBUG    volatility.framework: Importing module: volatility.plugins.timeliner
DEBUG    volatility.framework: Importing module: volatility.plugins.configwriter
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.pstree
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.lsmod
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.lsof
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.pslist
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.bash
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.psaux
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.check_sysctl
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.proc_maps
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.netstat
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.ifconfig
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.malfind
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.check_syscall
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.check_trap_table
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.tasks
DEBUG    volatility.framework: Importing module: volatility.plugins.mac.trustedbsd
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.psscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.dlldump
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.cmdline
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.poolscanner
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.mutantscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.pstree
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.dlllist
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.driverirp
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.info
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.verinfo
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.moddump
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.symlinkscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.strings
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.handles
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.virtmap
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.pslist
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.ssdt
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.vadyarascan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.vaddump
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.procdump
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.modules
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.filescan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.malfind
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.callbacks
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.driverscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.vadinfo
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.modscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.svcscan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.registry.userassist
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.registry.hivelist
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.registry.hivescan
DEBUG    volatility.framework: Importing module: volatility.plugins.windows.registry.printkey
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.check_afinfo
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.pstree
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.lsmod
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.lsof
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.proc
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.elfs
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.pslist
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.bash
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.malfind
DEBUG    volatility.framework: Importing module: volatility.plugins.linux.check_syscall
Level 6  volatility.framework: Importing from the following paths: /home/X/volatility3/volatility/framework/automagic
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.symbol_finder
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.stacker
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.pdbscan
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.construct_layers
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.symbol_cache
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.windows
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.linux
DEBUG    volatility.framework: Importing module: volatility.framework.automagic.mac
Level 7  root        : Cache directory used: /home/X/.cache/volatility3
INFO     volatility.framework.automagic: No plugin category detected
INFO     volatility.framework.automagic: Running automagic: SymbolBannerCache
INFO     volatility.framework.automagic: Running automagic: MacBannerCache
Level 6  volatility.framework.symbols.intermed: Searching for symbols in /home/X/volatility3/volatility/symbols, /home/X/volatility3/volatility/framework/symbols
INFO     volatility.framework.automagic: Running automagic: LinuxBannerCache
Level 6  volatility.framework.symbols.intermed: Searching for symbols in /home/X/volatility3/volatility/symbols, /home/X/volatility3/volatility/framework/symbols
INFO     volatility.framework.automagic.symbol_cache: Building linux caches...
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.YaraScan.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.YaraScan
INFO     volatility.framework.automagic: Running automagic: LayerStacker
Level 6  volatility.framework: Importing from the following paths: /home/X/volatility3/volatility/framework/layers
DEBUG    volatility.framework: Importing module: volatility.framework.layers.physical
DEBUG    volatility.framework: Importing module: volatility.framework.layers.linear
DEBUG    volatility.framework: Importing module: volatility.framework.layers.registry
DEBUG    volatility.framework: Importing module: volatility.framework.layers.lime
DEBUG    volatility.framework: Importing module: volatility.framework.layers.crash
DEBUG    volatility.framework: Importing module: volatility.framework.layers.elf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.intel
DEBUG    volatility.framework: Importing module: volatility.framework.layers.resources
DEBUG    volatility.framework: Importing module: volatility.framework.layers.segmented
DEBUG    volatility.framework: Importing module: volatility.framework.layers.msf
DEBUG    volatility.framework: Importing module: volatility.framework.layers.vmware
DEBUG    volatility.framework: Importing module: volatility.framework.layers.scanners.multiregexp
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WintelStacker
DEBUG    volatility.framework.automagic.windows: Self-referential pointer not in well-known location, moving to recent windows heuristic
Level 8  volatility.framework.automagic.stacker: Attempting to stack using VmwareStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LimeStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using Elf64Stacker
Level 6  volatility.framework.symbols.intermed: Searching for symbols in /home/X/volatility3/volatility/symbols, /home/X/volatility3/volatility/framework/symbols
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
Level 8  volatility.framework.automagic.stacker: Stacked Elf64Layer using Elf64Stacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WintelStacker
DEBUG    volatility.framework.automagic.windows: DTB was found at: 0x185000
Level 8  volatility.framework.automagic.stacker: Stacked IntelLayer using WintelStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using VmwareStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LimeStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WindowsCrashDump32Stacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using MacintelStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LintelStacker
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary.memory_layer
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.YaraScan.primary.memory_layer.base_layer
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
Level 6  volatility.framework.symbols.intermed: Searching for symbols in /home/X/volatility3/volatility/symbols, /home/X/volatility3/volatility/framework/symbols
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
INFO     volatility.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility.schemas: All validations will report success, even with malformed input
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
Level 9  volatility.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'Elf64Layer', 'FileLayer']
INFO     volatility.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility.framework.automagic: Running automagic: WintelHelper
INFO     volatility.framework.automagic: Running automagic: KernelPDBScanner
INFO     volatility.framework.automagic: Running automagic: SymbolFinder
INFO     volatility.framework.automagic: Running automagic: MacSymbolFinder
INFO     volatility.framework.automagic: Running automagic: LinuxSymbolFinder

Offset  Rule
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler

$ python vol.py -vvvvvv -f <path-to-macos-10-11-15A282a-x64>data.lime mac.pslist.PsList

...
DEBUG    volatility.framework.automagic.mac: Mac ASLR shift value determined: 0
Level 7  volatility.framework.automagic.stacker: Exception during stacking: ('Ma
cDTBTempLayer1', 18446743523965197008, 'Page Fault at entry 0xdce7ab3470f9d408 i
n table page directory pointer')
Level 6  volatility.framework.automagic.stacker: Traceback (most recent call las
t):

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/automagic/stacker.py", line 133, in stack
    new_layer = stacker.stack(new_context, current_layer_name, progress_callback
)

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/automagic/mac.py", line 110, in stack
    idlepml4_str = layer.read(idlepml4_ptr, 4)

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/interfaces/layers.py", line 377, in read
    for (offset, mapped_offset, mapped_length, layer) in self.mapping(offset, le
ngth, ignore_errors = pad):

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/layers/intel.py", line 205, in mapping
    chunk_offset, page_size, layer_name = self._translate(offset)

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/layers/intel.py", line 120, in _translate
    entry, position = self._translate_entry(offset)

  File "/Users/ilya/git/github.com/volatilityfoundation/volatility3/volatility/f
ramework/layers/intel.py", line 146, in _translate_entry
    "Page Fault at entry " + hex(entry) + " in table " + name)

volatility.framework.exceptions.PagedInvalidAddressException: ('MacDTBTempLayer1
', 18446743523965197008, 'Page Fault at entry 0xdce7ab3470f9d408 in table page d
irectory pointer')
...
Unsatisfied requirement plugins.PsList.primary: Memory layer for the kernel
Unsatisfied requirement plugins.PsList.darwin: Mac kernel symbols

A symbol table requirement was not fulfilled.  Please verify that:
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner


A translation layer requirement was not fulfilled.  Please verify that:
        A file was provided to create this layer (by -f, --single-location or by config)
        The file exists and is readable
        The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.PsList.primary', 'plugins.PsList.darwin'

$ xxd ~/.cache/volatility3/mac_banners.cache
00000000: 8003 7d71 0043 6144 6172 7769 6e20 4b65  ..}q.CaDarwin Ke
00000010: 726e 656c 2056 6572 7369 6f6e 2031 352e  rnel Version 15.
00000020: 302e 303a 2057 6564 2041 7567 2032 3620  0.0: Wed Aug 26
00000030: 3136 3a35 373a 3332 2050 4454 2032 3031  16:57:32 PDT 201
00000040: 353b 2072 6f6f 743a 786e 752d 3332 3437  5; root:xnu-3247
00000050: 2e31 2e31 3036 7e31 2f52 454c 4541 5345  .1.106~1/RELEASE
00000060: 5f58 3836 5f36 3400 7101 5d71 0258 6a00  _X86_64.q.]q.Xj.
00000070: 0000 6669 6c65 3a2f 2f2f 5573 6572 732f  ..file:///Users/
00000080: 696c 7961 2f67 6974 2f67 6974 6875 622e  ilya/git/github.
00000090: 636f 6d2f 766f 6c61 7469 6c69 7479 666f  com/volatilityfo
000000a0: 756e 6461 7469 6f6e 2f76 6f6c 6174 696c  undation/volatil
000000b0: 6974 7933 2f76 6f6c 6174 696c 6974 792f  ity3/volatility/
000000c0: 7379 6d62 6f6c 732f 6d61 632f 6b65 726e  symbols/mac/kern
000000d0: 656c 2e64 5359 4d2e 6a73 6f6e 7103 6173  el.dSYM.jsonq.as
000000e0: 2e

$ python3 vol.py --single-location "file:////mnt/hgfs/DEV/volatility3/20171213204935/memory/data.lime" windows.printkey.PrintKey

[snip]

	Last Write Time	Type	Key	Name	Data	Volatile
Traceback (most recent call last):
  File "vol.py", line 6, in <module>
    volatility.cli.main()
  File "/mnt/hgfs/DEV/volatility3/volatility/cli/__init__.py", line 304, in main
    CommandLine().run()
  File "/mnt/hgfs/DEV/volatility3/volatility/cli/__init__.py", line 189, in run
    text.QuickTextRenderer().render(constructed.run())
  File "/mnt/hgfs/DEV/volatility3/volatility/framework/renderers/text.py", line 57, in render
    grid.populate(visitor, outfd)
  File "/mnt/hgfs/DEV/volatility3/volatility/framework/renderers/__init__.py", line 160, in populate
    for (level, item) in self._generator:
  File "/mnt/hgfs/DEV/volatility3/volatility/plugins/windows/printkey.py", line 91, in registry_walker
    hive = RegistryHive(self.context, reg_config_path, name = 'hive' + hex(hive_offset), os = 'Windows')
  File "/mnt/hgfs/DEV/volatility3/volatility/framework/layers/registry.py", line 56, in __init__
    "Invalid registry base_block length: {}".format(self._base_block.Length))
volatility.framework.exceptions.StructureException: Invalid registry base_block length: 0

    "mm_struct": {
      "size": 1024,
      "fields": {
        "cpu_bitmap": {
          "type": {
            "count": 0,
            "kind": "array",
            "subtype": {
              "kind": "base",
              "name": "long unsigned int"
            }
          },
          "offset": 1024
        },
        "unnamed_field_0": {
          "type": {
            "kind": "struct",
            "name": "unnamed_b06fa817540c10e0"
          },
          "offset": 0
        }
      },
      "kind": "struct"
    },

PYTHONPATH="." python volatility/framework/symbols/windows/pdbconv.py -g E5900145FDB14BE5B18137FC2C81C7632 -p ntkrpamp.pdb -o test.json

Traceback (most recent call last):ocessing types                                                                                                  
  File "volatility/framework/symbols/windows/pdbconv.py", line 991, in <module>
    json.dump(convertor.get_json(), f, indent = 2, sort_keys = True)
  File "volatility/framework/symbols/windows/pdbconv.py", line 540, in get_json
    self.read_necessary_streams()
  File "volatility/framework/symbols/windows/pdbconv.py", line 330, in read_necessary_streams
    self.read_tpi_stream()
  File "volatility/framework/symbols/windows/pdbconv.py", line 380, in read_tpi_stream
    self.process_types(type_references)
  File "volatility/framework/symbols/windows/pdbconv.py", line 700, in process_types
    self.user_types = self.replace_forward_references(self.user_types, type_references)
  File "volatility/framework/symbols/windows/pdbconv.py", line 814, in replace_forward_references
    types[k] = self.replace_forward_references(v, type_references)
  File "volatility/framework/symbols/windows/pdbconv.py", line 814, in replace_forward_references
    types[k] = self.replace_forward_references(v, type_references)
  File "volatility/framework/symbols/windows/pdbconv.py", line 814, in replace_forward_references
    types[k] = self.replace_forward_references(v, type_references)
  [Previous line repeated 2 more times]
  File "volatility/framework/symbols/windows/pdbconv.py", line 838, in replace_forward_references
    return types.size // self.get_size_from_index(element_type)
  File "volatility/framework/symbols/windows/pdbconv.py", line 650, in get_size_from_index
    raise ValueError("Unable to determine size of leaf_type {}".format(leaf_type.lookup()))
ValueError: Unable to determine size of leaf_type LF_ARGLIST

"??_C@_1BM@FMDCFHKI@?$AAM?$AAe?$AAm?$AAo?$AAr?$AAy?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr@NNGAKEGL@": {
      "address": 7877184
    },

  "str:MemoryManager": 7877184, 

	5604	576	TrustedInstall	0x8c8f7c40	8	-	0	False	2016-09-11 10:18:09.000000 	N/A
	5644	664	TiWorker.exe	0x90d43040	8	-	0	False	2016-09-11 10:18:09.000000 	N/A
	4160	4252	surge-collect.	0x8bea2c40	7	-	1	False	2016-09-11 10:18:43.000000 	N/ATraceback (most recent call last):
  File "vol.py", line 6, in <module>
    volatility.cli.main()
  File "/Users/analyst/GitHub/volatility3/volatility/cli/__init__.py", line 297, in main
    CommandLine().run()
  File "/Users/analyst/GitHub/volatility3/volatility/cli/__init__.py", line 208, in run
    text.QuickTextRenderer().render(constructed.run())
  File "/Users/analyst/GitHub/volatility3/volatility/framework/renderers/text.py", line 118, in render
    grid.populate(visitor, outfd)
  File "/Users/analyst/GitHub/volatility3/volatility/framework/renderers/__init__.py", line 185, in populate
    for (level, item) in self._generator:
  File "/Users/analyst/GitHub/volatility3/volatility/plugins/windows/pslist.py", line 52, in _generator
    proc.get_create_time(),
  File "/Users/analyst/GitHub/volatility3/volatility/framework/symbols/windows/extensions/__init__.py", line 462, in get_create_time
    return utility.wintime_to_datetime(self.CreateTime)
  File "/Users/analyst/GitHub/volatility3/volatility/framework/objects/utility.py", line 50, in wintime_to_datetime
    return datetime.datetime.utcfromtimestamp(unix_time)
ValueError: year -19306 is out of range

In [1]: k = obj.Object("_KLDR_DATA_TABLE_ENTRY", offset=0xFFFFA0878DC37010, vm=addrspace())

In [2]: dt(k)
[CType _KLDR_DATA_TABLE_ENTRY] @ 0xFFFFA0878DC37010
0x0   : InLoadOrderLinks               18446639102792265744
0x10  : ExceptionTable                 18446735287116500992
0x18  : ExceptionTableSize             325764
0x20  : GpValue                        0
0x28  : NonPagedDebugInfo              0
0x30  : DllBase                        18446735287113007104
0x38  : EntryPoint                     18446735287116959760
0x40  : SizeOfImage                    8519680
0x48  : FullDllName                    \SystemRoot\system32\ntoskrnl.exe
0x58  : BaseDllName                    ntoskrnl.exe
0x68  : Flags                          142622720
0x6c  : LoadCount                      90
0x6e  : u1                             18446639102792265854
0x70  : SectionPointer                 0
0x78  : CheckSum                       7842901
0x7c  : CoverageSectionSize            0
0x80  : CoverageSection                0
0x88  : LoadedImports                  1
0x90  : Spare                          0
0x98  : SizeOfImageNotRounded          8519680
0x9c  : TimeDateStamp                  2016-07-16 02:16:17 UTC+0000

In [6]: m = obj.Object("_LDR_DATA_TABLE_ENTRY", offset=0xFFFFA0878DC37010, vm=addrspace())

In [7]: dt(m)
[_LDR_DATA_TABLE_ENTRY _LDR_DATA_TABLE_ENTRY] @ 0xFFFFA0878DC37010
0x0   : InLoadOrderLinks               18446639102792265744
0x10  : InMemoryOrderLinks             18446639102792265760
0x20  : InInitializationOrderLinks     18446639102792265776
0x30  : DllBase                        18446735287113007104
0x38  : EntryPoint                     18446735287116959760
0x40  : SizeOfImage                    8519680
0x48  : FullDllName                    \SystemRoot\system32\ntoskrnl.exe
0x58  : BaseDllName                    ntoskrnl.exe
[snip]
0xf8  : OriginalBase                   2080
0x100 : LoadTime                       1970-01-01 00:00:00 UTC+0000  # <--- ???
[snip]

10.0.17074.1000
10.0.15058.0
10.0.17661.1001
10.0.17134.319
10.0.10240.17113
10.0.17711.1000
10.0.17738.1000
10.0.10586.589
10.0.16299.125
10.0.10586.420
10.0.14300.1045
10.0.16291.0
10.0.10240.17918
10.0.14393.206
10.0.15063.786
10.0.10240.17914
10.0.14393.2007
10.0.14393.447
10.0.16299.431
10.0.10240.17609
10.0.10240.17354
10.0.10586.916
10.0.15063.1266
10.0.10240.17443
10.0.14393.953
10.0.14393.1480
10.0.15063.1387
10.0.17120.1
10.0.17763.1
10.0.15063.296
10.0.16278.1000
10.0.15063.1154
10.0.15063.1155
10.0.17035.1000
10.0.17123.1
10.0.10586.212
10.0.14393.1794
10.0.14393.2363
10.0.17040.1000
10.0.14300.1052
10.0.16299.192
10.0.17101.1000
10.0.16299.19
10.0.14393.351
10.0.14393.479
10.0.16299.248
10.0.17713.1000
10.0.15063.502
10.0.15063.1182
10.0.10586.962
10.0.10240.17184
10.0.17134.165
10.0.17134.167
10.0.17746.1000
10.0.10586.1295
10.0.17134.254
10.0.17133.1
10.0.10240.16430
10.0.10240.16431
10.0.10586.842
10.0.17758.1
10.0.16299.64
10.0.10240.17022
10.0.14393.576
10.0.16296.0
10.0.15063.1088
10.0.17093.1000
10.0.17692.1000
10.0.17134.345
10.0.10586.3
10.0.16299.551
10.0.17134.376
10.0.16299.98
10.0.10240.17831
10.0.16299.251
10.0.14986.1000
10.0.17704.1000
10.0.15063.332
10.0.14393.1066
10.0.14393.0
10.0.17127.1
10.0.17025.1000
10.0.10240.17533
10.0.17730.1000
10.0.15063.1029
10.0.17112.1
10.0.10240.16545
10.0.17735.1000
10.0.14393.1715
10.0.10586.1106
10.0.18262.1000
10.0.14393.1944
10.0.16299.309
10.0.17682.1000
10.0.17063.1000
10.0.16299.637
10.0.17744.1001
10.0.14393.1770
10.0.10240.16841
10.0.16299.0
10.0.17134.48
10.0.17755.1
10.0.16299.547
10.0.15063.483
10.0.16299.665
10.0.16299.666
10.0.10240.18005
10.0.15048.0
10.0.10586.672
10.0.18267.1001
10.0.17763.55
10.0.10586.1356
10.0.14300.1030
10.0.10240.16644
10.0.16299.785
10.0.10586.1540
10.0.14393.103
10.0.17128.1
10.0.15063.413
10.0.10586.1478
10.0.15063.729
10.0.16288.1
10.0.14393.2608
10.0.17017.1000
10.0.17107.1000
10.0.18252.1000
10.0.15063.726
10.0.10240.16393
10.0.17723.1000
10.0.17733.1000
10.0.14393.2311
10.0.14393.2312
10.0.18277.1000
10.0.16299.492
10.0.17134.191
10.0.14393.187
10.0.10586.306
10.0.16299.491
10.0.10240.17394
10.0.16299.15
10.0.10240.17797
10.0.16299.726
10.0.14393.321
10.0.16299.371
10.0.17134.407
10.0.17134.111
10.0.17134.112
10.0.15063.250
10.0.14393.2068
10.0.10586.1417
10.0.10586.17
10.0.10240.17488
10.0.10586.545
10.0.14393.729
10.0.17083.1000
10.0.10240.17643
10.0.15063.966
10.0.10586.1007
10.0.10240.17319
10.0.14393.726
10.0.10240.17738
10.0.17672.1000
10.0.14393.1358
10.0.15063.1206
10.0.15063.1209
10.0.15063.1324
10.0.17760.1
10.0.14393.2248
10.0.10586.1176
10.0.17754.1
10.0.10240.17946
10.0.17134.320
10.0.14393.1198
10.0.14300.1016
10.0.15063.540
10.0.10240.17861
10.0.14300.1010
10.0.17134.285
10.0.10240.17889
10.0.17134.286
10.0.14393.1593
10.0.15063.1292
10.0.10586.494
10.0.16251.0
10.0.15063.850
10.0.17677.1000
10.0.15063.11
10.0.15063.13
10.0.15063.14
10.0.10240.17146
10.0.10240.17071
10.0.14393.2368
10.0.14393.2430
10.0.15063.1446
10.0.16299.214
10.0.10240.17976
10.0.17666.1000
10.0.10240.17974
10.0.17133.73
10.0.17134.1
10.0.18272.1000
10.0.14300.1061
10.0.10240.17320
10.0.17134.137
10.0.14300.1066
10.0.10240.16590
10.0.10240.16463
10.0.16299.611
10.0.10586.839
10.0.15063.674
10.0.15063.909
10.0.14393.2485
10.0.14393.2125
10.0.10240.17709
10.0.17110.1000
10.0.15063.1112
10.0.14393.2551
10.0.14393.2189
10.0.17741.1000
10.0.15063.1356
10.0.17134.228
10.0.10586.1045
10.0.17751.1
10.0.17686.1003
10.0.17134.83
10.0.17134.81
10.0.15063.138
10.0.17115.1
10.0.15063.0
10.0.10586.103
10.0.17728.1000
10.0.10586.162
10.0.14393.693
10.0.10240.16724
10.0.15063.1418
10.0.18282.1000
10.0.10586.633
10.0.10240.17202
10.0.15002.1001
10.0.18290.1000
10.0.10240.17770
10.0.15063.608
10.0.15063.1235
10.0.10240.18036
10.0.10586.63
10.0.15063.447

6.3.9600.17668
6.0.6001.18377
6.3.9600.18896
6.1.7601.24059
6.3.9600.18340
6.3.9600.17328
6.0.6002.24339
6.3.9600.18685
6.1.7601.23002
5.2.3790.5107
6.1.7601.22436
6.0.6000.16386
6.2.9200.21703
6.2.9200.17637
6.2.9200.22008
6.1.7600.16988
6.0.6002.18832
6.0.6000.16754
5.2.3790.3309
6.0.6002.24521
6.0.6002.24520
6.3.9600.18194
6.2.9200.22432
6.1.7601.23250
6.1.7601.23313
6.0.6002.22183
6.0.6002.24202
5.2.3790.5190
6.2.9200.16551
5.2.3790.4637
6.0.6002.23588
6.1.7600.16917
6.1.7601.23796
6.1.7601.23418
6.2.9200.17557
6.1.7600.21207
5.1.2600.6284
6.1.7601.23677
6.3.9600.19153
6.0.6002.24381
6.0.6002.18082
5.1.2600.6368
5.1.2600.5512
6.0.6002.24065
6.0.6002.24412
6.2.9200.16384
6.3.9600.18589
6.1.7601.17514
6.3.9600.18895
6.2.9200.16864
6.1.7601.24291
6.0.6002.18075
6.1.7601.22921
6.3.9600.16384
6.0.6002.19279
6.0.6002.19573
5.1.2600.6055
6.0.6002.18881
6.1.7601.18741
6.1.7601.24094
6.1.7601.24093
6.0.6002.22831
6.2.9200.17528
6.1.7600.21094
6.0.6002.24463
6.0.6002.23761
6.0.6002.23762
6.0.6001.22389
6.1.7600.20826
6.3.9600.17630
6.2.9200.21428
6.2.9200.16604
6.3.9600.18790
6.3.9600.18264
6.1.7601.24009
6.1.7601.22943
6.0.6002.18484
6.0.6001.22478
6.1.7601.24000
6.1.7601.22948
6.1.7601.22379
6.3.9600.18090
6.1.7601.18409
6.0.6002.24367
6.0.6002.18686
6.2.9200.20652
5.2.3790.5157
6.0.6002.19697
6.0.6002.23905
6.3.9600.17031
6.1.7601.24260
6.1.7601.21847
6.2.9200.16548
6.2.9200.22108
6.0.6001.18427
5.1.2600.2622
6.2.9200.21736
6.0.6002.19454
6.0.6002.19453
6.0.6002.19598
5.2.3790.2894
5.1.2600.7053
6.2.9200.20555
6.2.9200.22547
5.2.3790.3959
6.0.6001.18063
6.2.9200.22462
6.0.6001.18145
6.0.6002.24108
6.1.7601.23223
5.1.2600.3654
5.1.2600.6419
6.1.7601.18700
6.0.6002.19594
6.0.6002.23636
6.3.9600.16452
6.1.7600.16539
6.1.7601.23126
6.3.9600.19101
6.0.6000.20697
6.2.9200.22490
6.0.6002.22283
6.2.9200.20605
6.2.9200.21368
6.2.9200.17231
6.0.6002.24421
6.2.9200.21815
6.2.9200.22280
6.0.6002.18533
6.3.9600.16422
5.2.3790.4998
6.1.7601.23455
6.3.9600.18758
6.1.7600.20738
6.2.9200.22086
6.1.7601.17803
6.3.9600.18289
5.2.3790.4354
6.1.7601.18933
6.3.9600.18969
6.2.9200.20733
6.2.9200.22005
6.1.7601.21987
6.3.9600.19038
6.2.9200.22001
6.3.9600.19035
6.1.7600.16385
6.0.6002.19790
6.2.9200.21674
5.2.3790.5059
5.1.2600.7017
5.1.2600.5913
5.1.2600.5857
6.1.7600.16695
6.0.6001.18538
5.1.2600.5938
6.1.7600.20994
5.1.2600.3610
6.2.9200.22254
5.1.2600.5755
6.3.9600.18146
6.2.9200.16420
5.1.2600.6335
6.1.7601.24214
6.0.6002.19700
6.0.6002.18765
6.0.6001.22167
6.1.7600.16841
6.1.7601.17944
6.0.6002.24078
6.1.7601.18939
6.0.6002.24170
6.1.7601.19018
6.1.7601.23807
6.0.6002.18160
5.1.2600.6206
6.2.9200.21914
6.0.6000.20670
6.0.6002.18005
6.0.6002.23076
6.0.6002.22662
5.1.2600.6748
6.0.6002.24282
6.2.9200.22601
6.0.6002.22920
6.2.9200.20772
6.3.9600.18007
6.3.9600.17415
6.0.6002.23824
6.0.6002.22420
6.0.6002.19514
6.3.9600.17238
6.1.7601.17835
6.0.6000.21175
6.0.6002.24346
6.2.9200.17581
6.1.7601.18205
5.2.3790.652
6.3.9600.17736
6.0.6001.22269
6.0.6002.22811
6.0.6001.22489
6.1.7601.23349
6.0.6002.23910
6.3.9600.17041
6.1.7601.18147
6.0.6002.19741
6.3.9600.18066
6.1.7601.17713
6.2.9200.21645
6.3.9600.19067
6.0.6000.16575
6.0.6001.22636
6.2.9200.20682
6.2.9200.20685
6.2.9200.22365
6.1.7601.23334
6.2.9200.21896
6.2.9200.22202
6.1.7601.23338
6.0.6002.19636
6.2.9200.22164
6.0.6001.18488
6.2.9200.16578
6.2.9200.16579
6.1.7601.18738
6.0.6002.18327
6.0.6002.24180
6.0.6002.19327
5.1.2600.3427
6.1.7601.23153
6.2.9200.22522
5.2.3790.5580
5.2.3790.5583
6.2.9200.17225
6.1.7601.19160
6.0.6002.24007
6.1.7601.19045
5.1.2600.1605
5.2.3790.4980
6.0.6002.23103
6.0.6002.22505
6.2.9200.16659
6.0.6000.20921
6.3.9600.18725
6.3.9600.17085
6.1.7601.18247
6.1.7601.22917
6.2.9200.20708
6.1.7600.16617
6.0.6002.24312
6.3.9600.18202
6.0.6002.22341
6.1.7601.23572
6.0.6002.23950
6.3.9600.19000
6.0.6002.23813
6.1.7601.22411
6.0.6000.16973
6.2.9200.20521
6.0.6000.21023
6.1.7601.21955
6.2.9200.16628
6.1.7600.20655
6.0.6000.21226
6.0.6002.18267
6.1.7601.19110
5.1.2600.7005
6.1.7601.22318
6.1.7601.24117
6.0.6002.24262
6.0.6001.22577
6.1.7600.20591
6.1.7600.16481
6.1.7601.23072
6.1.7601.23889
6.2.9200.22162
6.1.7601.17727
6.0.6002.23883
6.0.6002.22732
6.1.7601.24168
6.3.9600.18438
6.1.7600.21417
6.3.9600.16404
6.0.6001.22707
6.2.9200.17438
6.0.6001.18000
6.1.7601.18923
5.1.2600.3670
6.2.9200.21317
6.2.9200.22331
6.0.6000.20629
5.2.3790.4789
5.2.3790.0
6.0.6002.19858
6.0.6001.22777
5.2.3790.4666
6.2.9200.21339
6.0.6002.18209
6.3.9600.18931
6.1.7600.21179
5.2.3790.4478
6.1.7600.21077
6.2.9200.17313
6.1.7601.19135
6.2.9200.21548
6.2.9200.20984
6.1.7601.19131
6.3.9600.17936
6.0.6002.24444
6.3.9600.17933
6.1.7601.18798
6.1.7601.23864
6.2.9200.21830
6.2.9200.16581
6.1.7601.22280
6.0.6000.16830
6.0.6002.19503
6.2.9200.17617
5.1.2600.3520
6.3.9600.18946
6.1.7601.24024
6.1.7601.22908
5.1.2600.3093
6.3.9600.18379
6.3.9600.18378
6.1.7601.22210
6.2.9200.22376
6.3.9600.18696
6.1.7601.23403
6.0.6002.18595
6.1.7600.17273
6.1.7601.22137
5.1.2600.0
6.3.9600.18505
6.1.7601.21863
6.0.6000.16584
6.1.7601.17640
5.1.2600.5973
6.1.7601.23539
5.1.2600.5657
6.3.9600.18185
5.1.2600.6387
6.1.7601.23714
6.2.9200.22402
6.1.7600.21315
5.1.2600.160
6.3.9600.18258
6.1.7601.24236
6.1.7601.18044
6.1.7601.23915
6.2.9200.22170
6.1.7601.24231
6.0.6002.23025
6.0.6000.17021
6.0.6000.16514
6.1.7600.16905
5.2.3790.4922
6.0.6001.18295
6.3.9600.19125
6.1.7601.23142
6.3.9600.19128
6.2.9200.21347
6.0.6002.24154
5.1.2600.1634
6.2.9200.17214
6.1.7600.17017
6.0.6002.24089
6.2.9200.17218
6.1.7601.23391
6.1.7601.23392
5.1.2600.6223
6.2.9200.21971
6.0.6002.22191
6.3.9600.18730
6.0.6000.21101
6.1.7601.22923
6.0.6001.18226
6.1.7601.24060
6.1.7601.24290
6.1.7601.21755
5.2.3790.4035
6.2.9200.20655
6.2.9200.21369
6.3.9600.18233
6.3.9600.17476
6.0.6002.24491
5.1.2600.1568
5.2.3790.5138
6.2.9200.21756
6.0.6000.16901
6.3.9600.18423
6.1.7600.21490
6.0.6002.18805
6.1.7601.18229
6.1.7600.21980
6.1.7601.24150
6.0.6000.20707
6.0.6002.23935
6.1.7601.22103
6.0.6002.23936
6.0.6002.19680
6.1.7600.17207
6.2.9200.16496
6.0.6002.19764
6.0.6000.16551
6.1.7600.17795
6.1.7601.23569
6.2.9200.17251
6.1.7601.23564
6.2.9200.22570
6.1.7601.18113
5.1.2600.3704
5.2.3790.3191
6.1.7600.17118
6.0.6002.18607
6.1.7601.22616
6.3.9600.19179
6.1.7601.18717
6.2.9200.22227
6.1.7601.18715
6.1.7601.18711
6.2.9200.16451
6.0.6002.23154
5.2.3790.1830
6.0.6002.19346
5.1.2600.6165
6.1.7601.18869
5.2.3790.4566
6.2.9200.17213
6.3.9600.18821
6.0.6002.24400
6.1.7601.23136
6.0.6001.18304
6.0.6002.24024
6.0.6002.24020
6.0.6002.19834
6.0.6002.23654

PDB GUID: 80bdf49bd89d905be3a73d7f4226a90f1
Kernel filename: ntkrnlmp.pdb

root@t1:/shared/volatility3# python3 development/pdbparse-to-json.py -f /shared/windows10/ntkrnlmp.pdb -o /tmp/test.json
INFO     __main__    : Parsing PDB...
INFO     __main__    : Reading usertypes...
INFO     __main__    : Reading enums...
INFO     __main__    : Reading symbols...
Traceback (most recent call last):
  File "development/pdbparse-to-json.py", line 353, in <module>
    json.dump(convertor.read_pdb(), f, indent = 2, sort_keys = True)
  File "development/pdbparse-to-json.py", line 138, in read_pdb
    "base_types": self.read_basetypes()
  File "development/pdbparse-to-json.py", line 311, in read_basetypes
    "kind": self.ctype_python_types.get(self.ctype[index], "int"),
KeyError: EnumIntegerString.new(8, 'T_HRESULT')

2017-12-14 04:44:28	Key	ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT	Select		False
	2017-12-14 04:44:28	Key	ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT	Setup		False
	2017-12-14 04:44:28	Key	ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT	Software		False
	2017-12-14 04:44:28	Key	ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT\ControlSet001\Control\Arbiters\ROOT	WPA		False

0	0		0xad0ceefb9080	0	-	N/A	False	N/A	N/ATraceback (most recent call last):
  File "vol.py", line 10, in <module>
    volatility.cli.main()
  File "/volatility3/volatility/cli/__init__.py", line 442, in main
    CommandLine().run()
  File "/volatility3/volatility/cli/__init__.py", line 269, in run
    renderers[args.renderer]().render(constructed.run())
  File "/volatility3/volatility/cli/text_renderer.py", line 159, in render
    grid.populate(visitor, outfd)
  File "/volatility3/volatility/framework/renderers/__init__.py", line 196, in populate
    for (level, item) in self._generator:
  File "/volatility3/volatility/framework/plugins/windows/pslist.py", line 137, in _generator
    yield (0, (proc.UniqueProcessId, proc.InheritedFromUniqueProcessId,
  File "/volatility3/volatility/framework/objects/__init__.py", line 681, in __getattr__
    native_layer_name = self.vol.native_layer_name))
  File "/volatility3/volatility/framework/objects/templates.py", line 72, in __call__
    return self.vol.object_class(context = context, object_info = object_info, **arguments)
  File "/volatility3/volatility/framework/objects/__init__.py", line 113, in __new__
    value = cls._unmarshall(context, data_format, object_info)
  File "/volatility3/volatility/framework/objects/__init__.py", line 284, in _unmarshall
    data = context.layers.read(object_info.layer_name, object_info.offset, length)
  File "/volatility3/volatility/framework/interfaces/layers.py", line 492, in read
    return self[layer].read(offset, length, pad)
  File "/volatility3/volatility/framework/layers/linear.py", line 37, in read
    for (offset, mapped_offset, mapped_length, layer) in self.mapping(offset, length, ignore_errors = pad):
  File "/volatility3/volatility/framework/layers/intel.py", line 195, in mapping
    chunk_offset, page_size, layer_name = self._translate(offset)
  File "/volatility3/volatility/framework/layers/intel.py", line 317, in _translate
    return self._translate_swap(self, offset, self._bits_per_register // 2)
  File "/volatility3/volatility/framework/layers/intel.py", line 275, in _translate_swap
    return super()._translate(offset)
  File "/volatility3/volatility/framework/layers/intel.py", line 100, in _translate
    entry, position = self._translate_entry(offset)
  File "/volatility3/volatility/framework/layers/intel.py", line 143, in _translate_entry
    "Page Fault at entry " + hex(entry) + " in table " + name)
volatility.framework.exceptions.PagedInvalidAddressException: Page Fault at entry 0xb9b76063 in table page table