{"action":"opened","issue":{"url":"https://api.github.com/repos/google/rekall/issues/94","labels_url":"https://api.github.com/repos/google/rekall/issues/94/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/94/comments","events_url":"https://api.github.com/repos/google/rekall/issues/94/events","html_url":"https://github.com/google/rekall/issues/94","id":106183464,"number":94,"title":"pstree can't handle \"special\" characters in process names ","user":{"login":"pettai","id":3317462,"avatar_url":"https://avatars.githubusercontent.com/u/3317462?v=3","gravatar_id":"","url":"https://api.github.com/users/pettai","html_url":"https://github.com/pettai","followers_url":"https://api.github.com/users/pettai/followers","following_url":"https://api.github.com/users/pettai/following{/other_user}","gists_url":"https://api.github.com/users/pettai/gists{/gist_id}","starred_url":"https://api.github.com/users/pettai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pettai/subscriptions","organizations_url":"https://api.github.com/users/pettai/orgs","repos_url":"https://api.github.com/users/pettai/repos","events_url":"https://api.github.com/users/pettai/events{/privacy}","received_events_url":"https://api.github.com/users/pettai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-12T20:29:10Z","updated_at":"2015-09-12T20:29:10Z","closed_at":null,"body":"Installed on Ubuntu 14.04 with pip install rekall:\r\n\r\n-bash-4.3$ rekal --version\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nThis is Rekall Version 1.4.1 (Etzel)\r\n{u'full-revisionid': u'4cdeec0bb7c04e0d6fa65cc66c608a89980a80c8', u'dirty': False, u'version': u'1.4.1', u'error': None}\r\n\r\n-bash-4.3$ rekal -f FS1-20150603-152148.raw pstree\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\n_EPROCESS                                 PPid   Thds   Hnds            Time\r\n---------------------------------------- ------ ------ ------ ------------------------\r\n  0xfa80051f44b0 csrss.exe (484)            472     13    507 2015-05-13 06:08:58+0000\r\n  0xfa80052109c0 wininit.exe (536)          472      3     99 2015-05-13 06:09:07+0000\r\n. 0xfa8004ea2c10 services.exe (612)         536      6    265 2015-05-13 06:09:11+0000\r\n.. 0xfa8005339750 SLsvc.exe (228)           612      4     96 2015-05-13 06:09:19+0000\r\n.. 0xfa80053d6860 svchost.exe (288)         612     24    651 2015-05-13 06:09:21+0000\r\n... 0xfa8005ce3c10 rdpclip.exe (2900)       288      4    130 2015-05-13 06:10:47+0000\r\n.. 0xfa8005358c10 svchost.exe (436)         612     19    363 2015-05-13 06:09:19+0000\r\n.. 0xfa8005481c10 vmtoolsd.exe (440)        612      6    297 2015-05-13 06:09:34+0000\r\n.. 0xfa8005389730 svchost.exe (696)         612     22    312 2015-05-13 06:09:20+0000\r\n... 0xfa8003cd1c10 dwm.exe (2996)           696      3     86 2015-05-13 06:10:47+0000\r\n.. 0xfa80052c3040 svchost.exe (820)         612      7    300 2015-05-13 06:09:18+0000\r\n.. 0xfa80052ecc10 svchost.exe (880)         612      7    286 2015-05-13 06:09:19+0000\r\n.. 0xfa8005316c10 svchost.exe (956)         612     15    295 2015-05-13 06:09:19+0000\r\n.. 0xfa800532b510 svchost.exe (1004)        612      6    237 2015-05-13 06:09:19+0000\r\n.. 0xfa8005333ae0 svchost.exe (1020)        612     43   1712 2015-05-13 06:09:19+0000\r\n... 0xfa8005565040 taskeng.exe (1756)      1020      5    165 2015-05-13 06:09:36+0000\r\n... 0xfa8005cdfc10 taskeng.exe (2860)      1020      9    265 2015-05-13 06:10:46+0000\r\n.. 0xfa800540fc10 svchost.exe (1124)        612     17    268 2015-05-13 06:09:22+0000\r\n.. 0xfa80054e4260 svchost.exe (1412)        612      5    125 2015-05-13 06:09:29+0000\r\n.. 0xfa80054e0b80 svchost.exe (1424)        612      3     73 2015-05-13 06:09:29+0000\r\nCRITICAL:rekall.1:Traceback (most recent call last):\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/session.py\", line 725, in RunPlugin\r\n    result = plugin_obj.render(ui_renderer) or plugin_obj\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 96, in render\r\n    draw_children(0, root)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 91, in draw_children\r\n    draw_children(pad + 1, task.UniqueProcessId)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 91, in draw_children\r\n    draw_children(pad + 1, task.UniqueProcessId)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 74, in draw_children\r\n    task.CreateTime, depth=pad, parent=pid)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1370, in table_row\r\n    super(TextRenderer, self).table_row(*args, **kwargs)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/renderer.py\", line 462, in table_row\r\n    self.table.render_row(row=row, **kwargs)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1152, in render_row\r\n    return self.write_row(self.get_row(*row, **options),\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1145, in get_row\r\n    tablesep=self.options.get(\"tablesep\", \" \"))\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 656, in __init__\r\n    self.rebuild()\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 704, in rebuild\r\n    line = self.tablesep.join(parts)\r\nUnicodeDecodeError: 'ascii' codec can't decode byte 0xa0 in position 26: ordinal not in range(128)\r\n\r\nCRITICAL:root:'ascii' codec can't decode byte 0xa0 in position 26: ordinal not in range(128). Try --debug for more information.\r\nTraceback (most recent call last):\r\n  File \"/usr/local/bin/rekal\", line 9, in <module>\r\n    load_entry_point('rekall-core==1.4.1', 'console_scripts', 'rekal')()\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/rekal.py\", line 108, in main\r\n    user_session.RunPlugin(plugin_cls, **config.RemoveGlobalOptions(flags))\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/session.py\", line 728, in RunPlugin\r\n    self._HandleRunPluginException(ui_renderer, e)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/session.py\", line 725, in RunPlugin\r\n    result = plugin_obj.render(ui_renderer) or plugin_obj\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 96, in render\r\n    draw_children(0, root)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 91, in draw_children\r\n    draw_children(pad + 1, task.UniqueProcessId)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 91, in draw_children\r\n    draw_children(pad + 1, task.UniqueProcessId)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/plugins/windows/pstree.py\", line 74, in draw_children\r\n    task.CreateTime, depth=pad, parent=pid)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1370, in table_row\r\n    super(TextRenderer, self).table_row(*args, **kwargs)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/renderer.py\", line 462, in table_row\r\n    self.table.render_row(row=row, **kwargs)\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1152, in render_row\r\n    return self.write_row(self.get_row(*row, **options),\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 1145, in get_row\r\n    tablesep=self.options.get(\"tablesep\", \" \"))\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 656, in __init__\r\n    self.rebuild()\r\n  File \"/usr/local/lib/python2.7/dist-packages/rekall/ui/text.py\", line 704, in rebuild\r\n    line = self.tablesep.join(parts)\r\nUnicodeDecodeError: 'ascii' codec can't decode byte 0xa0 in position 26: ordinal not in range(128)\r\n\r\nThe process it bails out on has a \"hidden\" character, which shows in pslist\r\n(Related to https://github.com/log2timeline/plaso/issues/323)\r\n\r\n-bash-4.3$ rekal -f FS1-20150603-152148.raw pslist\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\nWARNING:rekall.1:Cache directory inaccessible. Disabling.\r\n  _EPROCESS            Name          PID   PPID   Thds    Hnds    Sess  Wow64           Start                     Exit\r\n-------------- -------------------- ----- ------ ------ -------- ------ ------ ------------------------ ------------------------\r\n0xfa8003ca9040 System                   4      0    104      585      - False  2015-05-13 06:08:26+0000 -\r\n0xfa8005339750 SLsvc.exe              228    612      4       96      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa80053d6860 svchost.exe            288    612     24      651      0 False  2015-05-13 06:09:21+0000 -\r\n0xfa8004d1ec10 smss.exe               416      4      4       31      - False  2015-05-13 06:08:26+0000 -\r\n0xfa8005358c10 svchost.exe            436    612     19      363      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa8005481c10 vmtoolsd.exe           440    612      6      297      0 False  2015-05-13 06:09:34+0000 -\r\n0xfa80051f44b0 csrss.exe              484    472     13      507      0 False  2015-05-13 06:08:58+0000 -\r\n0xfa800520b540 csrss.exe              528    520      7       81      1 False  2015-05-13 06:09:06+0000 -\r\n0xfa80052109c0 wininit.exe            536    472      3       99      0 False  2015-05-13 06:09:07+0000 -\r\n0xfa80052132f0 winlogon.exe           564    520      3      102      1 False  2015-05-13 06:09:07+0000 -\r\n0xfa8004ea2c10 services.exe           612    536      6      265      0 False  2015-05-13 06:09:11+0000 -\r\n0xfa800523a9d0 lsass.exe              624    536     13      733      0 False  2015-05-13 06:09:11+0000 -\r\n0xfa800523dba0 lsm.exe                632    536     10      245      0 False  2015-05-13 06:09:11+0000 -\r\n0xfa8005c1ac10 explorer.exe           684   2948     25      771      2 False  2015-05-13 06:10:47+0000 -\r\n0xfa8005389730 svchost.exe            696    612     22      312      0 False  2015-05-13 06:09:20+0000 -\r\n0xfa80052c3040 svchost.exe            820    612      7      300      0 False  2015-05-13 06:09:18+0000 -\r\n0xfa80052ecc10 svchost.exe            880    612      7      286      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa800530d1b0 LogonUI.exe            948    564      8      172      1 False  2015-05-13 06:09:19+0000 -\r\n0xfa8005316c10 svchost.exe            956    612     15      295      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa80069dd6f0 chrome.exe             976    684     28      844      2 True   2015-06-03 15:19:53+0000 -\r\n0xfa800532b510 svchost.exe           1004    612      6      237      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa8005333ae0 svchost.exe           1020    612     43     1712      0 False  2015-05-13 06:09:19+0000 -\r\n0xfa800540fc10 svchost.exe           1124    612     17      268      0 False  2015-05-13 06:09:22+0000 -\r\n0xfa800552f040 FirewallControl       1400    684      5      157      2 False  2015-06-03 15:13:24+0000 -\r\n0xfa80054e4260 svchost.exe           1412    612      5      125      0 False  2015-05-13 06:09:29+0000 -\r\n0xfa80054e0b80 svchost.exe           1424    612      3       73      0 False  2015-05-13 06:09:29+0000 -\r\n0xfa80055010d0 svchost.exe�          1472    612      7      107      0 True   2015-05-13 06:09:29+0000 - \r\n[...]\r\n"}}