{"action":"closed","issue":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/193","labels_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/193/labels{/name}","comments_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/193/comments","events_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/193/events","html_url":"https://github.com/volatilityfoundation/volatility/issues/193","id":60022714,"number":193,"title":"No valid DTB found - Win 8/8.1/2012 64bit vmem > 4GB","user":{"login":"Sebastienbr","id":2241339,"avatar_url":"https://avatars.githubusercontent.com/u/2241339?v=3","gravatar_id":"","url":"https://api.github.com/users/Sebastienbr","html_url":"https://github.com/Sebastienbr","followers_url":"https://api.github.com/users/Sebastienbr/followers","following_url":"https://api.github.com/users/Sebastienbr/following{/other_user}","gists_url":"https://api.github.com/users/Sebastienbr/gists{/gist_id}","starred_url":"https://api.github.com/users/Sebastienbr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sebastienbr/subscriptions","organizations_url":"https://api.github.com/users/Sebastienbr/orgs","repos_url":"https://api.github.com/users/Sebastienbr/repos","events_url":"https://api.github.com/users/Sebastienbr/events{/privacy}","received_events_url":"https://api.github.com/users/Sebastienbr/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-05T21:56:58Z","updated_at":"2015-04-02T02:56:32Z","closed_at":"2015-04-02T02:56:32Z","body":"Conditions for the problem:\r\n- Vmem memory dump \r\n- Win 8/8.1/2012 64bit \r\n- Dump is > 4GB\r\n- Vmss metadata file is present\r\n- Vmware metadata fill the gap between 0xC0000000 and 0x100000000\r\n\r\nDuring the voting round, FileAddressSpace and VMWareMetaAddressSpace are correctly loaded but AMD64PagedMemory failed to load (no valid DTB found). \r\n\r\nIf I manually pad the Win 8/8.1/2012 64bit vmem memory dump (between 0xC0000000 and 0x100000000) and I rename them to .dd (to avoid loading the vmem address space), FileAddressSpace and AMD64PagedMemory are correctly loaded and my dump can be analysed.\r\n\r\nAny ideas why dtb is not found when VMWareMetaAddressSpace is used?\r\nhttps://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/addrspaces/paged.py#L68\r\n\r\nThanks again for your help,\r\n\r\nSebastien\r\n \r\n\r\n"}}