{"action":"created","issue":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/206","labels_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/206/comments","events_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/206/events","html_url":"https://github.com/volatilityfoundation/volatility/issues/206","id":65732529,"number":206,"title":"iehistory plugin hangs","user":{"login":"apapadop","id":10215088,"avatar_url":"https://avatars.githubusercontent.com/u/10215088?v=3","gravatar_id":"","url":"https://api.github.com/users/apapadop","html_url":"https://github.com/apapadop","followers_url":"https://api.github.com/users/apapadop/followers","following_url":"https://api.github.com/users/apapadop/following{/other_user}","gists_url":"https://api.github.com/users/apapadop/gists{/gist_id}","starred_url":"https://api.github.com/users/apapadop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apapadop/subscriptions","organizations_url":"https://api.github.com/users/apapadop/orgs","repos_url":"https://api.github.com/users/apapadop/repos","events_url":"https://api.github.com/users/apapadop/events{/privacy}","received_events_url":"https://api.github.com/users/apapadop/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-04-01T17:05:24Z","updated_at":"2015-04-08T15:11:23Z","closed_at":null,"body":"Hello\r\n\r\nI am getting consistently \"hung\" when attempting to timeline some memory samples. Example:\r\n$ time vol.py -d -f image.mem --profile Win7SP1x64 timeliner --output=body 2> err.out 1> timeliner.txt\r\n^C\r\nreal\t8m31.373s\r\nuser\t7m34.789s\r\nsys\t0m56.946s\r\n\r\nThere is hardly anything after 8' of 100% CPU time (I have waited upto an hour with the same results, we seem to be stuck in a loop):\r\n$ cat timeliner.txt \r\n0|[LIVE RESPONSE] (System time)|0|---------------|0|0|0|1425407721|1425407721|1425407721|1425407721\r\n0|[IEHISTORY] VsTskMgr.exe->ules cannot be inserted inside a group rule. PID: 2416/Cache type \"URL \" at 0x7623da4c|0|---------------|0|0|0|731345888087|736772473609|731345888087|731345888087\r\nInterrupted\r\n\r\nAll other plugins I tried (pslist/psxview/malfind/shellbags/mftparser) appear to work fine. Similarly, the timeliner plugin works fine for plenty other memory samples I've examined.\r\n\r\nThis is the debug output:\r\n\r\n$ cat err.out \r\nVolatility Foundation Volatility Framework 2.4\r\nDEBUG   : volatility.obj      : Applying modification from AtomTablex64Overlay\r\nDEBUG   : volatility.obj      : Applying modification from BasicObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from BigPageTableMagic\r\nDEBUG   : volatility.obj      : Applying modification from BitmapDmpVTypes\r\nDEBUG   : volatility.obj      : Applying modification from ControlAreaModification\r\nDEBUG   : volatility.obj      : Applying modification from ELF32Modification\r\nDEBUG   : volatility.obj      : Applying modification from ELF64Modification\r\nDEBUG   : volatility.obj      : Applying modification from ELFModification\r\nDEBUG   : volatility.obj      : Applying modification from EditBoxObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from EditBoxVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HPAKVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HandleTableEntryPreWin8\r\nDEBUG   : volatility.obj      : Applying modification from IEHistoryVTypes\r\nDEBUG   : volatility.obj      : Applying modification from LimeTypes\r\nDEBUG   : volatility.obj      : Applying modification from MachoModification\r\nDEBUG   : volatility.obj      : Applying modification from MachoTypes\r\nDEBUG   : volatility.obj      : Applying modification from MbrObjectTypes\r\nDEBUG   : volatility.obj      : Applying modification from PoolTagModification\r\nDEBUG   : volatility.obj      : Applying modification from PoolTrackTagOverlay\r\nDEBUG   : volatility.obj      : Applying modification from SSLKeyModification\r\nDEBUG   : volatility.obj      : Applying modification from UnloadedDriverVTypes\r\nDEBUG   : volatility.obj      : Applying modification from VMwareVTypesModification\r\nDEBUG   : volatility.obj      : Applying modification from VirtualBoxModification\r\nDEBUG   : volatility.obj      : Applying modification from Win32KGahtiVType\r\nDEBUG   : volatility.obj      : Applying modification from Win32Kx64VTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP01x64Syscalls\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP1x64GuiVTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win7Vista2008x64Tcpip\r\nDEBUG   : volatility.obj      : Applying modification from Win7Vista2008x64Timers\r\nDEBUG   : volatility.obj      : Applying modification from WinSyscallsAttribute\r\nDEBUG   : volatility.obj      : Applying modification from Win7GuiOverlay\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64Tcpip\r\nDEBUG   : volatility.obj      : Applying modification from WindowsVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HiberWin7SP01x64\r\nDEBUG   : volatility.obj      : Applying modification from ObjectTypeKeyModification\r\nDEBUG   : volatility.obj      : Applying modification from PoolTrackTypeOverlay\r\nDEBUG   : volatility.obj      : Applying modification from ProcessAuditVTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win64SyscallVTypes\r\nDEBUG   : volatility.obj      : Applying modification from WindowsOverlay\r\nDEBUG   : volatility.obj      : Applying modification from CallbackMods\r\nDEBUG   : volatility.obj      : Applying modification from EThreadCreateTime\r\nDEBUG   : volatility.obj      : Applying modification from MalwarePspCid\r\nDEBUG   : volatility.obj      : Applying modification from TimerVTypes\r\nDEBUG   : volatility.obj      : Applying modification from UserAssistVTypes\r\nDEBUG   : volatility.obj      : Applying modification from VadFlagsModification\r\nDEBUG   : volatility.obj      : Applying modification from VadTagModification\r\nDEBUG   : volatility.obj      : Applying modification from VistaPolicyKey\r\nDEBUG   : volatility.obj      : Applying modification from VistaVad\r\nDEBUG   : volatility.obj      : Applying modification from VistaWin7KPCR\r\nDEBUG   : volatility.obj      : Applying modification from Win7LdrDataTableEntry\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP1CMHIVE\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64Hiber\r\nDEBUG   : volatility.obj      : Applying modification from WinAllTime\r\nDEBUG   : volatility.obj      : Applying modification from WinPEObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from WinPEVTypes\r\nDEBUG   : volatility.obj      : Applying modification from WindowsObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from AudipolWin7\r\nDEBUG   : volatility.obj      : Applying modification from CmdHistoryObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from CmdHistoryVTypesWin7x64\r\nDEBUG   : volatility.obj      : Applying modification from CrashInfoModification\r\nDEBUG   : volatility.obj      : Applying modification from ExFastRefx64\r\nDEBUG   : volatility.obj      : Applying modification from HeapModification\r\nDEBUG   : volatility.obj      : Applying modification from KDBGObjectClass\r\nDEBUG   : volatility.obj      : Applying modification from KPCRProfileModification\r\nDEBUG   : volatility.obj      : Applying modification from MFTTYPES\r\nDEBUG   : volatility.obj      : Applying modification from MalwareDrivers\r\nDEBUG   : volatility.obj      : Applying modification from MalwareKthread\r\nDEBUG   : volatility.obj      : Applying modification from NetscanObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from PFTYPES_W7\r\nDEBUG   : volatility.obj      : Applying modification from ServiceBase\r\nDEBUG   : volatility.obj      : Applying modification from ShellBagsTypesWin7\r\nDEBUG   : volatility.obj      : Applying modification from ShimCacheTypesWin7x64\r\nDEBUG   : volatility.obj      : Applying modification from USNRecordTypes\r\nDEBUG   : volatility.obj      : Applying modification from UserAssistWin7VTypes\r\nDEBUG   : volatility.obj      : Applying modification from VistaObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win32KCoreClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win7KDBG\r\nDEBUG   : volatility.obj      : Applying modification from Win7ObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from WinPEx64VTypes\r\nDEBUG   : volatility.obj      : Applying modification from Windows64Overlay\r\nDEBUG   : volatility.obj      : Applying modification from ServiceBasex64\r\nDEBUG   : volatility.obj      : Applying modification from ServiceVista\r\nDEBUG   : volatility.obj      : Applying modification from ServiceVistax64\r\nDEBUG   : volatility.obj      : Applying modification from Win7Win32KCoreClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64DTB\r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> \r\nDEBUG   : volatility.obj      : Applying modification from AtomTablex64Overlay\r\nDEBUG   : volatility.obj      : Applying modification from BasicObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from BigPageTableMagic\r\nDEBUG   : volatility.obj      : Applying modification from BitmapDmpVTypes\r\nDEBUG   : volatility.obj      : Applying modification from ControlAreaModification\r\nDEBUG   : volatility.obj      : Applying modification from ELF32Modification\r\nDEBUG   : volatility.obj      : Applying modification from ELF64Modification\r\nDEBUG   : volatility.obj      : Applying modification from ELFModification\r\nDEBUG   : volatility.obj      : Applying modification from EditBoxObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from EditBoxVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HPAKVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HandleTableEntryPreWin8\r\nDEBUG   : volatility.obj      : Applying modification from IEHistoryVTypes\r\nDEBUG   : volatility.obj      : Applying modification from LimeTypes\r\nDEBUG   : volatility.obj      : Applying modification from MachoModification\r\nDEBUG   : volatility.obj      : Applying modification from MachoTypes\r\nDEBUG   : volatility.obj      : Applying modification from MbrObjectTypes\r\nDEBUG   : volatility.obj      : Applying modification from PoolTagModification\r\nDEBUG   : volatility.obj      : Applying modification from PoolTrackTagOverlay\r\nDEBUG   : volatility.obj      : Applying modification from SSLKeyModification\r\nDEBUG   : volatility.obj      : Applying modification from UnloadedDriverVTypes\r\nDEBUG   : volatility.obj      : Applying modification from VMwareVTypesModification\r\nDEBUG   : volatility.obj      : Applying modification from VirtualBoxModification\r\nDEBUG   : volatility.obj      : Applying modification from Win32KGahtiVType\r\nDEBUG   : volatility.obj      : Applying modification from Win32Kx64VTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP01x64Syscalls\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP1x64GuiVTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win7Vista2008x64Tcpip\r\nDEBUG   : volatility.obj      : Applying modification from Win7Vista2008x64Timers\r\nDEBUG   : volatility.obj      : Applying modification from WinSyscallsAttribute\r\nDEBUG   : volatility.obj      : Applying modification from Win7GuiOverlay\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64Tcpip\r\nDEBUG   : volatility.obj      : Applying modification from WindowsVTypes\r\nDEBUG   : volatility.obj      : Applying modification from HiberWin7SP01x64\r\nDEBUG   : volatility.obj      : Applying modification from ObjectTypeKeyModification\r\nDEBUG   : volatility.obj      : Applying modification from PoolTrackTypeOverlay\r\nDEBUG   : volatility.obj      : Applying modification from ProcessAuditVTypes\r\nDEBUG   : volatility.obj      : Applying modification from Win64SyscallVTypes\r\nDEBUG   : volatility.obj      : Applying modification from WindowsOverlay\r\nDEBUG   : volatility.obj      : Applying modification from CallbackMods\r\nDEBUG   : volatility.obj      : Applying modification from EThreadCreateTime\r\nDEBUG   : volatility.obj      : Applying modification from MalwarePspCid\r\nDEBUG   : volatility.obj      : Applying modification from TimerVTypes\r\nDEBUG   : volatility.obj      : Applying modification from UserAssistVTypes\r\nDEBUG   : volatility.obj      : Applying modification from VadFlagsModification\r\nDEBUG   : volatility.obj      : Applying modification from VadTagModification\r\nDEBUG   : volatility.obj      : Applying modification from VistaPolicyKey\r\nDEBUG   : volatility.obj      : Applying modification from VistaVad\r\nDEBUG   : volatility.obj      : Applying modification from VistaWin7KPCR\r\nDEBUG   : volatility.obj      : Applying modification from Win7LdrDataTableEntry\r\nDEBUG   : volatility.obj      : Applying modification from Win7SP1CMHIVE\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64Hiber\r\nDEBUG   : volatility.obj      : Applying modification from WinAllTime\r\nDEBUG   : volatility.obj      : Applying modification from WinPEObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from WinPEVTypes\r\nDEBUG   : volatility.obj      : Applying modification from WindowsObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from AudipolWin7\r\nDEBUG   : volatility.obj      : Applying modification from CmdHistoryObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from CmdHistoryVTypesWin7x64\r\nDEBUG   : volatility.obj      : Applying modification from CrashInfoModification\r\nDEBUG   : volatility.obj      : Applying modification from ExFastRefx64\r\nDEBUG   : volatility.obj      : Applying modification from HeapModification\r\nDEBUG   : volatility.obj      : Applying modification from KDBGObjectClass\r\nDEBUG   : volatility.obj      : Applying modification from KPCRProfileModification\r\nDEBUG   : volatility.obj      : Applying modification from MFTTYPES\r\nDEBUG   : volatility.obj      : Applying modification from MalwareDrivers\r\nDEBUG   : volatility.obj      : Applying modification from MalwareKthread\r\nDEBUG   : volatility.obj      : Applying modification from NetscanObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from PFTYPES_W7\r\nDEBUG   : volatility.obj      : Applying modification from ServiceBase\r\nDEBUG   : volatility.obj      : Applying modification from ShellBagsTypesWin7\r\nDEBUG   : volatility.obj      : Applying modification from ShimCacheTypesWin7x64\r\nDEBUG   : volatility.obj      : Applying modification from USNRecordTypes\r\nDEBUG   : volatility.obj      : Applying modification from UserAssistWin7VTypes\r\nDEBUG   : volatility.obj      : Applying modification from VistaObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win32KCoreClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win7KDBG\r\nDEBUG   : volatility.obj      : Applying modification from Win7ObjectClasses\r\nDEBUG   : volatility.obj      : Applying modification from WinPEx64VTypes\r\nDEBUG   : volatility.obj      : Applying modification from Windows64Overlay\r\nDEBUG   : volatility.obj      : Applying modification from ServiceBasex64\r\nDEBUG   : volatility.obj      : Applying modification from ServiceVista\r\nDEBUG   : volatility.obj      : Applying modification from ServiceVistax64\r\nDEBUG   : volatility.obj      : Applying modification from Win7Win32KCoreClasses\r\nDEBUG   : volatility.obj      : Applying modification from Win7x64DTB\r\nDEBUG   : volatility.utils    : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0x7f6789fecc10>\r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Succeeded instantiating <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x7f678a1aef10>\r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> \r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> \r\nDEBUG   : volatility.utils    : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0x7f678a1b94d0>\r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Succeeded instantiating <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x7f678a1b9490>\r\nDEBUG   : volatility.utils    : Voting round\r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crashbmp.WindowsCrashDumpSpace64BitMap'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmem.VMWareMetaAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.VirtualBoxCoreDumpElf64'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.elfcoredump.QemuCoreDumpElf'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.osxpmemelf.OSXPmemELF'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> \r\nDEBUG   : volatility.utils    : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> \r\n$ \r\n\r\n[[version of Volatility I'm using]]\r\n$ vol.py --info\r\nVolatility Foundation Volatility Framework 2.4\r\n\r\nPlugins\r\n-------\r\napihooks                   - Detect API hooks in process and kernel memory\r\napihooksdeep               - Detect API hooks in process and kernel memory, with ssdeep for whitelisting\r\natoms                      - Print session and window station atom tables\r\natomscan                   - Pool scanner for atom tables\r\nauditpol                   - Prints out the Audit Policies from HKLM\\SECURITY\\Policy\\PolAdtEv\r\nautoruns                   - Searches the registry and memory space for applications running at system startup and maps them to running processes\r\nbigpools                   - Dump the big page pools using BigPagePoolScanner\r\nbioskbd                    - Reads the keyboard buffer from Real Mode memory\r\ncachedump                  - Dumps cached domain hashes from memory\r\ncallbacks                  - Print system-wide notification routines\r\nchromecookies              - Scans for and parses potential Chrome cookie data\r\nchromedownloadchains       - Scans for and parses potential Chrome download chain records\r\nchromedownloads            - Scans for and parses potential Chrome download records\r\nchromehistory              - Scans for and parses potential Chrome url history\r\nchromesearchterms          - Scans for and parses potential Chrome keyword search terms\r\nchromevisits               - Scans for and parses potential Chrome url visits data -- VERY SLOW, see -Q option\r\nclipboard                  - Extract the contents of the windows clipboard\r\ncmdline                    - Display process command-line arguments\r\ncmdscan                    - Extract command history by scanning for _COMMAND_HISTORY\r\nconnections                - Print list of open connections [Windows XP and 2003 Only]\r\nconnscan                   - Pool scanner for tcp connections\r\nconsoles                   - Extract command history by scanning for _CONSOLE_INFORMATION\r\ncrashinfo                  - Dump crash-dump information\r\ndeskscan                   - Poolscaner for tagDESKTOP (desktops)\r\ndevicetree                 - Show device tree\r\ndlldump                    - Dump DLLs from a process address space\r\ndlllist                    - Print list of loaded dlls for each process\r\ndriverbl                   - Scans memory for driver objects and compares the results with the baseline image\r\ndriverirp                  - Driver IRP hook detection\r\ndriverscan                 - Pool scanner for driver objects\r\ndumpcerts                  - Dump RSA private and public SSL keys\r\ndumpfiles                  - Extract memory mapped and cached files\r\neditbox                    - Dumps various data from ComCtl Edit controls (experimental: ListBox, ComboBox)\r\nenvars                     - Display process environment variables\r\neventhooks                 - Print details on windows event hooks\r\nevtlogs                    - Extract Windows Event Logs (XP/2003 only)\r\nfilescan                   - Pool scanner for file objects\r\nfirefoxcookies             - Scans for and parses potential Firefox cookies (cookies.sqlite moz_cookies table\r\nfirefoxdownloads           - Scans for and parses potential Firefox download records -- downloads.sqlite moz_downloads table pre FF26 only\r\nfirefoxhistory             - Scans for and parses potential Firefox url history (places.sqlite moz_places table)\r\ngahti                      - Dump the USER handle type information\r\ngditimers                  - Print installed GDI timers and callbacks\r\ngdt                        - Display Global Descriptor Table\r\ngetservicesids             - Get the names of services in the Registry and return Calculated SID\r\ngetsids                    - Print the SIDs owning each process\r\nhandles                    - Print list of open handles for each process\r\nhashdump                   - Dumps passwords hashes (LM/NTLM) from memory\r\nhibinfo                    - Dump hibernation file information\r\nhivedump                   - Prints out a hive\r\nhivelist                   - Print list of registry hives.\r\nhivescan                   - Pool scanner for registry hives\r\nhpakextract                - Extract physical memory from an HPAK file\r\nhpakinfo                   - Info on an HPAK file\r\nidt                        - Display Interrupt Descriptor Table\r\nidxparser                  - Scans for and parses Java IDX files\r\niehistory                  - Reconstruct Internet Explorer cache / history\r\nimagecopy                  - Copies a physical address space out as a raw DD image\r\nimageinfo                  - Identify information for the image\r\nimpscan                    - Scan for calls to imported functions\r\njoblinks                   - Print process job link information\r\nkdbgscan                   - Search for and dump potential KDBG values\r\nkpcrscan                   - Search for and dump potential KPCR values\r\nldrmodules                 - Detect unlinked DLLs\r\nlimeinfo                   - Dump Lime file format information\r\nlinux_apihooks             - Checks for userland apihooks\r\nlinux_arp                  - Print the ARP table\r\nlinux_banner               - Prints the Linux banner information\r\nlinux_bash                 - Recover bash history from bash process memory\r\nlinux_bash_env             - Recover bash's environment variables\r\nlinux_bash_hash            - Recover bash hash table from bash process memory\r\nlinux_check_afinfo         - Verifies the operation function pointers of network protocols\r\nlinux_check_creds          - Checks if any processes are sharing credential structures\r\nlinux_check_evt_arm        - Checks the Exception Vector Table to look for syscall table hooking\r\nlinux_check_fop            - Check file operation structures for rootkit modifications\r\nlinux_check_idt            - Checks if the IDT has been altered\r\nlinux_check_inline_kernel  - Check for inline kernel hooks\r\nlinux_check_modules        - Compares module list to sysfs info, if available\r\nlinux_check_syscall        - Checks if the system call table has been altered\r\nlinux_check_syscall_arm    - Checks if the system call table has been altered\r\nlinux_check_tty            - Checks tty devices for hooks\r\nlinux_cpuinfo              - Prints info about each active processor\r\nlinux_dentry_cache         - Gather files from the dentry cache\r\nlinux_dmesg                - Gather dmesg buffer\r\nlinux_dump_map             - Writes selected memory mappings to disk\r\nlinux_elfs                 - Find ELF binaries in process mappings\r\nlinux_enumerate_files      - Lists files referenced by the filesystem cache\r\nlinux_find_file            - Lists and recovers files from memory\r\nlinux_hidden_modules       - Carves memory to find hidden kernel modules\r\nlinux_ifconfig             - Gathers active interfaces\r\nlinux_info_regs            - It's like 'info registers' in GDB. It prints out all the\r\nlinux_iomem                - Provides output similar to /proc/iomem\r\nlinux_kernel_opened_files  - Lists files that are opened from within the kernel\r\nlinux_keyboard_notifiers   - Parses the keyboard notifier call chain\r\nlinux_ldrmodules           - Compares the output of proc maps with the list of libraries from libdl\r\nlinux_library_list         - Lists libraries loaded into a process\r\nlinux_librarydump          - Dumps shared libraries in process memory to disk\r\nlinux_list_raw             - List applications with promiscuous sockets\r\nlinux_lsmod                - Gather loaded kernel modules\r\nlinux_lsof                 - Lists open files\r\nlinux_malfind              - Looks for suspicious process mappings\r\nlinux_memmap               - Dumps the memory map for linux tasks\r\nlinux_moddump              - Extract loaded kernel modules\r\nlinux_mount                - Gather mounted fs/devices\r\nlinux_mount_cache          - Gather mounted fs/devices from kmem_cache\r\nlinux_netfilter            - Lists Netfilter hooks\r\nlinux_netstat              - Lists open sockets\r\nlinux_pidhashtable         - Enumerates processes through the PID hash table\r\nlinux_pkt_queues           - Writes per-process packet queues out to disk\r\nlinux_plthook              - Scan ELF binaries' PLT for hooks to non-NEEDED images\r\nlinux_proc_maps            - Gathers process maps for linux\r\nlinux_proc_maps_rb         - Gathers process maps for linux through the mappings red-black tree\r\nlinux_procdump             - Dumps a process's executable image to disk\r\nlinux_process_hollow       - Checks for signs of process hollowing\r\nlinux_psaux                - Gathers processes along with full command line and start time\r\nlinux_psenv                - Gathers processes along with their environment\r\nlinux_pslist               - Gather active tasks by walking the task_struct->task list\r\nlinux_pslist_cache         - Gather tasks from the kmem_cache\r\nlinux_pstree               - Shows the parent/child relationship between processes\r\nlinux_psxview              - Find hidden processes with various process listings\r\nlinux_recover_filesystem   - Recovers the entire cached file system from memory\r\nlinux_route_cache          - Recovers the routing cache from memory\r\nlinux_sk_buff_cache        - Recovers packets from the sk_buff kmem_cache\r\nlinux_slabinfo             - Mimics /proc/slabinfo on a running machine\r\nlinux_strings              - Match physical offsets to virtual addresses (may take a while, VERY verbose)\r\nlinux_threads              - Prints threads of processes\r\nlinux_tmpfs                - Recovers tmpfs filesystems from memory\r\nlinux_truecrypt_passphrase - Recovers cached Truecrypt passphrases\r\nlinux_vma_cache            - Gather VMAs from the vm_area_struct cache\r\nlinux_volshell             - Shell in the memory image\r\nlinux_yarascan             - A shell in the Linux memory image\r\nlsadump                    - Dump (decrypted) LSA secrets from the registry\r\nmac_adium                  - Lists Adium messages\r\nmac_apihooks               - Checks for API hooks in processes\r\nmac_apihooks_kernel        - Checks to see if system call and kernel functions are hooked\r\nmac_arp                    - Prints the arp table\r\nmac_bash                   - Recover bash history from bash process memory\r\nmac_bash_env               - Recover bash's environment variables\r\nmac_bash_hash              - Recover bash hash table from bash process memory\r\nmac_calendar               - Gets calendar events from Calendar.app\r\nmac_check_mig_table        - Lists entires in the kernel's MIG table\r\nmac_check_syscall_shadow   - Looks for shadow system call tables\r\nmac_check_syscalls         - Checks to see if system call table entries are hooked\r\nmac_check_sysctl           - Checks for unknown sysctl handlers\r\nmac_check_trap_table       - Checks to see if mach trap table entries are hooked\r\nmac_contacts               - Gets contact names from Contacts.app\r\nmac_dead_procs             - Prints terminated/de-allocated processes\r\nmac_dead_sockets           - Prints terminated/de-allocated network sockets\r\nmac_dead_vnodes            - Lists freed vnode structures\r\nmac_dmesg                  - Prints the kernel debug buffer\r\nmac_dump_file              - Dumps a specified file\r\nmac_dump_maps              - Dumps memory ranges of processes\r\nmac_dyld_maps              - Gets memory maps of processes from dyld data structures\r\nmac_find_aslr_shift        - Find the ASLR shift value for 10.8+ images\r\nmac_ifconfig               - Lists network interface information for all devices\r\nmac_ip_filters             - Reports any hooked IP filters\r\nmac_keychaindump           - Recovers possbile keychain keys. Use chainbreaker to open related keychain files\r\nmac_ldrmodules             - Compares the output of proc maps with the list of libraries from libdl\r\nmac_librarydump            - Dumps the executable of a process\r\nmac_list_files             - Lists files in the file cache\r\nmac_list_sessions          - Enumerates sessions\r\nmac_list_zones             - Prints active zones\r\nmac_lsmod                  - Lists loaded kernel modules\r\nmac_lsmod_iokit            - Lists loaded kernel modules through IOkit\r\nmac_lsmod_kext_map         - Lists loaded kernel modules\r\nmac_lsof                   - Lists per-process opened files\r\nmac_machine_info           - Prints machine information about the sample\r\nmac_malfind                - Looks for suspicious process mappings\r\nmac_memdump                - Dump addressable memory pages to a file\r\nmac_moddump                - Writes the specified kernel extension to disk\r\nmac_mount                  - Prints mounted device information\r\nmac_netstat                - Lists active per-process network connections\r\nmac_network_conns          - Lists network connections from kernel network structures\r\nmac_notesapp               - Finds contents of Notes messages\r\nmac_notifiers              - Detects rootkits that add hooks into I/O Kit (e.g. LogKext)\r\nmac_pgrp_hash_table        - Walks the process group hash table\r\nmac_pid_hash_table         - Walks the pid hash table\r\nmac_print_boot_cmdline     - Prints kernel boot arguments\r\nmac_proc_maps              - Gets memory maps of processes\r\nmac_procdump               - Dumps the executable of a process\r\nmac_psaux                  - Prints processes with arguments in user land (**argv)\r\nmac_pslist                 - List Running Processes\r\nmac_pstree                 - Show parent/child relationship of processes\r\nmac_psxview                - Find hidden processes with various process listings\r\nmac_recover_filesystem     - Recover the cached filesystem\r\nmac_route                  - Prints the routing table\r\nmac_socket_filters         - Reports socket filters\r\nmac_strings                - Match physical offsets to virtual addresses (may take a while, VERY verbose)\r\nmac_tasks                  - List Active Tasks\r\nmac_trustedbsd             - Lists malicious trustedbsd policies\r\nmac_version                - Prints the Mac version\r\nmac_volshell               - Shell in the memory image\r\nmac_yarascan               - Scan memory for yara signatures\r\nmachoinfo                  - Dump Mach-O file format information\r\nmalfind                    - Find hidden and injected code\r\nmalfinddeep                - Find hidden and injected code, whitelist with ssdeep hashes\r\nmalprocfind                - Finds malicious processes based on discrepancies from observed, normal behavior and properties\r\nmalsysproc                 - Find malware hiding in plain sight as system processes\r\nmbrparser                  - Scans for and parses potential Master Boot Records (MBRs)\r\nmemdump                    - Dump the addressable memory for a process\r\nmemmap                     - Print the memory map\r\nmessagehooks               - List desktop and thread window message hooks\r\nmftparser                  - Scans for and parses potential MFT entries\r\nmimikatz                   - mimikatz offline\r\nmoddump                    - Dump a kernel driver to an executable file sample\r\nmodscan                    - Pool scanner for kernel modules\r\nmodules                    - Print list of loaded modules\r\nmultiscan                  - Scan for various objects at once\r\nmutantscan                 - Pool scanner for mutex objects\r\nnetscan                    - Scan a Vista (or later) image for connections and sockets\r\nnotepad                    - List currently displayed notepad text\r\nobjtypescan                - Scan for Windows object type objects\r\npatcher                    - Patches memory based on page scans\r\npoolpeek                   - Configurable pool scanner plugin\r\npooltracker                - Show a summary of pool tag usage\r\nprefetchparser             - Scans for and parses potential Prefetch files\r\nprintkey                   - Print a registry key, and its subkeys and values\r\nprivs                      - Display process privileges\r\nprocdump                   - Dump a process to an executable file sample\r\nprocessbl                  - Scans memory for processes and loaded DLLs and compares the results with the baseline\r\npslist                     - Print all running processes by following the EPROCESS lists\r\npsscan                     - Pool scanner for process objects\r\npstotal                    - Combination of pslist,psscan & pstree --output=dot gives graphical representation\r\npstree                     - Print process list as a tree\r\npsxview                    - Find hidden processes with various process listings\r\nraw2dmp                    - Converts a physical memory sample to a windbg crash dump\r\nscreenshot                 - Save a pseudo-screenshot based on GDI windows\r\nservicebl                  - Scans memory for service objects and compares the results with the baseline image\r\nsessions                   - List details on _MM_SESSION_SPACE (user logon sessions)\r\nshellbags                  - Prints ShellBags info\r\nshimcache                  - Parses the Application Compatibility Shim Cache registry key\r\nsockets                    - Print list of open sockets\r\nsockscan                   - Pool scanner for tcp socket objects\r\nssdeepscan                 - Scan process or kernel memory with SSDeep signatures\r\nssdt                       - Display SSDT entries\r\nstrings                    - Match physical offsets to virtual addresses (may take a while, VERY verbose)\r\nsvcscan                    - Scan for Windows services\r\nsymlinkscan                - Pool scanner for symlink objects\r\nthrdscan                   - Pool scanner for thread objects\r\nthreads                    - Investigate _ETHREAD and _KTHREADs\r\ntimeliner                  - Creates a timeline from various artifacts in memory\r\ntimers                     - Print kernel timers and associated module DPCs\r\ntruecryptmaster            - Recover TrueCrypt 7.1a Master Keys\r\ntruecryptpassphrase        - TrueCrypt Cached Passprhase Finder\r\ntruecryptsummary           - TrueCrypt Summary\r\ntrustrecords               - Extract MS Office TrustRecords from the Registry\r\nuninstallinfo              - Extract installed software info from Uninstall registry key\r\nunloadedmodules            - Print list of unloaded modules\r\nuserassist                 - Print userassist registry keys and information\r\nuserhandles                - Dump the USER handle tables\r\nusnparser                  - Scans for and parses USN journal records\r\nvaddump                    - Dumps out the vad sections to a file\r\nvadinfo                    - Dump the VAD info\r\nvadtree                    - Walk the VAD tree and display in tree format\r\nvadwalk                    - Walk the VAD tree\r\nvboxinfo                   - Dump virtualbox information\r\nverinfo                    - Prints out the version information from PE images\r\nvmwareinfo                 - Dump VMware VMSS/VMSN information\r\nvolshell                   - Shell in the memory image\r\nwindows                    - Print Desktop Windows (verbose details)\r\nwintree                    - Print Z-Order Desktop Windows Tree\r\nwndscan                    - Pool scanner for window stations\r\nyarascan                   - Scan process or kernel memory with Yara signatures\r\n\r\n\r\nProfiles\r\n--------\r\nVistaSP0x64     - A Profile for Windows Vista SP0 x64\r\nVistaSP0x86     - A Profile for Windows Vista SP0 x86\r\nVistaSP1x64     - A Profile for Windows Vista SP1 x64\r\nVistaSP1x86     - A Profile for Windows Vista SP1 x86\r\nVistaSP2x64     - A Profile for Windows Vista SP2 x64\r\nVistaSP2x86     - A Profile for Windows Vista SP2 x86\r\nWin2003SP0x86   - A Profile for Windows 2003 SP0 x86\r\nWin2003SP1x64   - A Profile for Windows 2003 SP1 x64\r\nWin2003SP1x86   - A Profile for Windows 2003 SP1 x86\r\nWin2003SP2x64   - A Profile for Windows 2003 SP2 x64\r\nWin2003SP2x86   - A Profile for Windows 2003 SP2 x86\r\nWin2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64\r\nWin2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64\r\nWin2008SP1x64   - A Profile for Windows 2008 SP1 x64\r\nWin2008SP1x86   - A Profile for Windows 2008 SP1 x86\r\nWin2008SP2x64   - A Profile for Windows 2008 SP2 x64\r\nWin2008SP2x86   - A Profile for Windows 2008 SP2 x86\r\nWin2012R2x64    - A Profile for Windows Server 2012 R2 x64\r\nWin2012x64      - A Profile for Windows Server 2012 x64\r\nWin7SP0x64      - A Profile for Windows 7 SP0 x64\r\nWin7SP0x86      - A Profile for Windows 7 SP0 x86\r\nWin7SP1x64      - A Profile for Windows 7 SP1 x64\r\nWin7SP1x86      - A Profile for Windows 7 SP1 x86\r\nWin8SP0x64      - A Profile for Windows 8 SP0 x64\r\nWin8SP0x86      - A Profile for Windows 8 SP0 x86\r\nWin8SP1x64      - A Profile for Windows 8.1 x64\r\nWin8SP1x86      - A Profile for Windows 8 SP1 x86\r\nWinXPSP1x64     - A Profile for Windows XP SP1 x64\r\nWinXPSP2x64     - A Profile for Windows XP SP2 x64\r\nWinXPSP2x86     - A Profile for Windows XP SP2 x86\r\nWinXPSP3x86     - A Profile for Windows XP SP3 x86\r\n\r\n\r\nScanner Checks\r\n--------------\r\nCheckPoolSize          - Check pool block size\r\nCheckPoolType          - Check the pool type\r\nKPCRScannerCheck       - Checks the self referential pointers to find KPCRs\r\nMultiPrefixFinderCheck - Checks for multiple strings per page, finishing at the offset\r\nMultiStringFinderCheck - Checks for multiple strings per page\r\nPoolTagCheck           - This scanner checks for the occurance of a pool tag\r\n\r\n\r\nAddress Spaces\r\n--------------\r\nAMD64PagedMemory              - Standard AMD 64-bit address space.\r\nArmAddressSpace               - No docs        \r\nFileAddressSpace              - This is a direct file AS.\r\nHPAKAddressSpace              - This AS supports the HPAK format\r\nIA32PagedMemory               - Standard IA-32 paging address space.\r\nIA32PagedMemoryPae            - This class implements the IA-32 PAE paging address space. It is responsible\r\nLimeAddressSpace              - Address space for Lime\r\nMachOAddressSpace             - Address space for mach-o files to support atc-ny memory reader\r\nOSXPmemELF                    - This AS supports VirtualBox ELF64 coredump format\r\nQemuCoreDumpElf               - This AS supports Qemu ELF32 and ELF64 coredump format\r\nVMWareAddressSpace            - This AS supports VMware snapshot (VMSS) and saved state (VMSS) files\r\nVMWareMetaAddressSpace        - This AS supports the VMEM format with VMSN/VMSS metadata\r\nVirtualBoxCoreDumpElf64       - This AS supports VirtualBox ELF64 coredump format\r\nWindowsCrashDumpSpace32       - This AS supports windows Crash Dump format\r\nWindowsCrashDumpSpace64       - This AS supports windows Crash Dump format\r\nWindowsCrashDumpSpace64BitMap - This AS supports Windows BitMap Crash Dump format\r\nWindowsHiberFileSpace32       - This is a hibernate address space for windows hibernation files.\r\n\r\n[[The operating system used to run volatility]]\r\n$ uname -a\r\nLinux gtw 3.13.0-43-generic #72-Ubuntu SMP Mon Dec 8 19:35:06 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n[[The version of python used to run volatility]]\r\nPython 2.7.6\r\n\r\n[[The suspected operating system of the memory image]]\r\nWin7SP1x64\r\n\r\n[[The complete command line you used to run volatility]]\r\n$ time vol.py -d -f image.mem --profile Win7SP1x64 timeliner --output=body 2> err.out 1> timeliner.txt\r\n"},"comment":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/comments/90946100","html_url":"https://github.com/volatilityfoundation/volatility/issues/206#issuecomment-90946100","issue_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/206","id":90946100,"user":{"login":"apapadop","id":10215088,"avatar_url":"https://avatars.githubusercontent.com/u/10215088?v=3","gravatar_id":"","url":"https://api.github.com/users/apapadop","html_url":"https://github.com/apapadop","followers_url":"https://api.github.com/users/apapadop/followers","following_url":"https://api.github.com/users/apapadop/following{/other_user}","gists_url":"https://api.github.com/users/apapadop/gists{/gist_id}","starred_url":"https://api.github.com/users/apapadop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apapadop/subscriptions","organizations_url":"https://api.github.com/users/apapadop/orgs","repos_url":"https://api.github.com/users/apapadop/repos","events_url":"https://api.github.com/users/apapadop/events{/privacy}","received_events_url":"https://api.github.com/users/apapadop/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T15:11:23Z","updated_at":"2015-04-08T15:11:23Z","body":"Sorry for delay.\r\nYes, latest dev version appears to fix the issue. Both iehistory and timeliner plugins work as expected.\r\nThank you!"}}