Volatility Workbench keeps crashing after refreshing process list.

[cicak.dinding]

Hi,

Tested the workbench on several memory dumps, from 8 Gb to 15 Gb memory. Also tested memory dump from Win7 and Win 10.

Seems that the Workbench crashes after it successfully parse out the plist from the memory.

Also tried running the workbench from different computer, same outcome (crashes immediately after the plist items are shown on the UI).

Can help to check it out?

Thanks.

[David (PassMark)]

We'll have a look.
Would it be possible to Zip up one of those dumps and upload it to OneDrive DropBox or similar?

[cicak.dinding]

Hi,

I just tested again today, strangely the UI did not crash for the 64 bit 8 Gb memory. My Windows Build is 18362.

Now that it did not crash, may need to check the parsing - see below process list and plist output. Some warning and the process name seems truncated.

Thanks.

Time Stamp: Thu Dec 26 16:21:42 2019
"C:\Users\<snip>\Desktop\volatility\volatility.exe " --plugins="C:\Users\<snip>\Desktop\volatility\profil es" pstree --filename="C:\Users\<snip>\Desktop\Comae_Toolkit\x6 4\<snip>-20191226-080938.dmp" --profile=Win10x64_17763 --kdbg=0xf8056a4265e0

Please wait, this may take a few minutes.

Time Stamp: Thu Dec 26 16:22:20 2019
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
0xffffd78b1a9b40c8:exe 1536 684 0 ------ 2019-12-26 08:06:05 UTC+0000
. 0xffffd78b1aa33088:exe 1712 1536 0 ------ 2019-12-26 08:06:05 UTC+0000
0xffffd78b1b5ad088:exe 4608 684 0 ------ 2019-12-26 08:06:08 UTC+0000
0xffffd78b1a862088:exe 1108 684 0 ------ 2019-12-26 08:06:05 UTC+0000
0xffffd78b114dd088:Servic 8 684 32768 ------ 2019-12-26 08:06:06 UTC+0000
0xffffd78b1ab34088:exe 2064 684 0 ------ 2019-12-26 08:06:05 UTC+0000
. 0xffffd78b20c1d088e 7496 2064 0 ------ 2019-12-26 08:06:16 UTC+0000
0xffffd78b26126088:ce.exe 12888 684 32768 ------ 2019-12-26 08:08:15 UTC+0000
0xffffd78b20ceb0c8:exe 7700 684 0 ------ 2019-12-26 08:06:16 UTC+0000
0xffffd78b1aa68088:exe 1756 684 0 ------ 2019-12-26 08:06:05 UTC+0000
0xffffd78b1b2cc088nder. 516 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
. 0xffffd78b182f4088:e 536 516 0 ------ 2019-12-26 08:06:02 UTC+0000
. 0xffffd78b18c5f088:exe 612 516 32768 ------ 2019-12-26 08:06:03 UTC+0000
.. 0xffffd78b18ca4088:.exe 684 612 32768 ------ 2019-12-26 08:06:03 UTC+0000
... 0xffffd78b1b3c90c8:exe 4128 684 0 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b1ac54088:exe 2224 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1a9bb088:exe 1572 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1ae7b248:exe 2908 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b26b8a088:er.exe 13380 684 32768 ------ 2019-12-26 08:08:14 UTC+0000
... 0xffffd78b1ac130c8:exe 2096 684 32768 ------ 2019-12-26 08:06:05 UTC+0000
.... 0xffffd78b18027088:Heartb 6352 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b268e9088:date.e 10704 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b20c8b088:.exe 10708 2096 32768 ------ 2019-12-26 08:08:17 UTC+0000
.... 0xffffd78b23b21088:e 11132 2096 4 ------ 2019-12-26 08:06:36 UTC+0000
.... 0xffffd78b1a809088:e 12284 2096 32768 ------ 2019-12-26 08:06:57 UTC+0000
.... 0xffffd78b27295088:date.e 13072 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b20e240c8:e.exe 7960 2096 0 ------ 2019-12-26 08:06:17 UTC+0000
.... 0xffffd78b20e22088:w.exe 7968 2096 0 ------ 2019-12-26 08:06:17 UTC+0000
.... 0xffffd78b272770c8:lRunne 7716 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
..... 0xffffd78b270ec0c8:exe 1172 7716 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b26d99088:Standa 8140 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b2612f488:RClien 3156 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b26136088:.exe 6600 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b263b1088:e 11616 2096 0 ------ 2019-12-26 08:06:47 UTC+0000
.... 0xffffd78b26af0088:RClien 4396 2096 32768 ------ 2019-12-26 08:09:06 UTC+0000
.... 0xffffd78b23ff4188nRans 8916 2096 0 ------ 2019-12-26 08:06:21 UTC+0000
... 0xffffd78b1b178088:exe 3636 684 32772 ------ 2019-12-26 08:06:07 UTC+0000
... 0xffffd78b1b646088:exe 4656 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
.... 0xffffd78b26b92088: 12856 4656 32768 ------ 2019-12-26 08:07:05 UTC+0000
.... 0xffffd78b26f9e088: 14328 4656 32768 ------ 2019-12-26 08:07:19 UTC+0000
.... 0xffffd78b235840c8: 5912 4656 32768 ------ 2019-12-26 08:06:42 UTC+0000
.... 0xffffd78b24dc3088: 8456 4656 32768 ------ 2019-12-26 08:06:39 UTC+0000
.... 0xffffd78b24a3d088: 13716 4656 32768 ------ 2019-12-26 08:07:49 UTC+0000
.... 0xffffd78b24cef088: 11592 4656 32768 ------ 2019-12-26 08:06:47 UTC+0000
.... 0xffffd78b2668d088: 12012 4656 32768 ------ 2019-12-26 08:06:56 UTC+0000
.... 0xffffd78b26fd9088: 12096 4656 32768 ------ 2019-12-26 08:07:24 UTC+0000
.... 0xffffd78b20dc0088: 9964 4656 32768 ------ 2019-12-26 08:06:30 UTC+0000
.... 0xffffd78b24cea0c8: 12220 4656 32768 ------ 2019-12-26 08:06:51 UTC+0000
.... 0xffffd78b23eee088: 9624 4656 32768 ------ 2019-12-26 08:08:21 UTC+0000
.... 0xffffd78b243860c8: 8596 4656 32768 ------ 2019-12-26 08:06:24 UTC+0000
.... 0xffffd78b23b19088: 11844 4656 32768 ------ 2019-12-26 08:06:49 UTC+0000
.... 0xffffd78b23b15088: 10908 4656 32768 ------ 2019-12-26 08:06:36 UTC+0000
.... 0xffffd78b24750088: 2720 4656 32768 ------ 2019-12-26 08:06:32 UTC+0000
.... 0xffffd78b26e7e088: 13276 4656 32768 ------ 2019-12-26 08:07:32 UTC+0000
.... 0xffffd78b27094088: 14020 4656 32768 ------ 2019-12-26 08:07:16 UTC+0000
.... 0xffffd78b1b94c488: 5088 4656 32768 ------ 2019-12-26 08:06:09 UTC+0000
... 0xffffd78b1b644088e 4664 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
.... 0xffffd78b1bff0088:b.exe 5892 4664 1 ------ 2019-12-26 08:06:10 UTC+0000
.... 0xffffd78b1c0230c8:b.exe 5876 4664 1 ------ 2019-12-26 08:06:10 UTC+0000
... 0xffffd78b24873088:exe 9652 684 0 ------ 2019-12-26 08:06:32 UTC+0000
... 0xffffd78b24062088:exe 8764 684 0 ------ 2019-12-26 08:06:20 UTC+0000
... 0xffffd78b1afc7088:exe 3136 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b1a869088:exe 1120 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b24384088:exe 8772 684 0 ------ 2019-12-26 08:06:24 UTC+0000
... 0xffffd78b1afca088:exe 3144 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b268e2088:exe 12448 684 0 ------ 2019-12-26 08:07:03 UTC+0000
... 0xffffd78b1c14f088:exe 2636 684 0 ------ 2019-12-26 08:06:15 UTC+0000
... 0xffffd78b1adeb088:exe 2744 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b270f0088:exe 13744 684 0 ------ 2019-12-26 08:09:08 UTC+0000
... 0xffffd78b1ada5088:exe 2644 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b1bcea0c8:exe 5476 684 0 ------ 2019-12-26 08:06:09 UTC+0000
... 0xffffd78b1a85d248:exe 1116 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b26a5b088:exe 12568 684 0 ------ 2019-12-26 08:07:03 UTC+0000
... 0xffffd78b1b78a0c8:exe 4712 684 0 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b1adea0c8:exe 2668 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b1b19d088:exe 3696 684 0 ------ 2019-12-26 08:06:07 UTC+0000
... 0xffffd78b1e975088:exe 13416 684 0 ------ 2019-12-26 08:09:06 UTC+0000
... 0xffffd78b1a9fe088:exe 1656 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1aaea0c8:exe 1876 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b260e9088:Health 10876 684 32768 ------ 2019-12-26 08:06:44 UTC+0000
... 0xffffd78b1ac3f088:y.exe 2180 684 32770 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1a8660c8:exe 1132 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1ac42088:exe 2188 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1b5b0088:Servic 4632 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
.... 0xffffd78b1c69b088:.exe 7260 4632 32768 ------ 2019-12-26 08:06:15 UTC+0000
..... 0xffffd78b20c1a088:.exe 7472 7260 32768 ------ 2019-12-26 08:06:16 UTC+0000
...... 0xffffd78b23b4b088er.ex 8324 7472 1 ------ 2019-12-26 08:06:18 UTC+0000
... 0xffffd78b1b1bb0c8:exe 3732 684 0 ------ 2019-12-26 08:06:07 UTC+0000
... 0xffffd78b20dbf088:exe 9780 684 0 ------ 2019-12-26 08:06:29 UTC+0000
... 0xffffd78b1b2c2088:layDev 4036 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b1ac570c8:exe 2204 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b23d920c8:exe 8352 684 0 ------ 2019-12-26 08:06:18 UTC+0000
... 0xffffd78b263660c8:ce.exe 11428 684 32768 ------ 2019-12-26 08:06:46 UTC+0000
.... 0xffffd78b2636d088:t.exe 11504 11428 32768 ------ 2019-12-26 08:06:46 UTC+0000
... 0xffffd78b1aa460c8:exe 1700 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1b421088:exe 4264 684 0 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b1bfe3088:.exe 7524 684 32768 ------ 2019-12-26 08:08:14 UTC+0000
... 0xffffd78b1ae2f088:exe 2732 684 0 ------ 2019-12-26 08:06:06 UTC+0000
... 0xffffd78b26df1088:exe 14056 684 0 ------ 2019-12-26 08:09:09 UTC+0000
... 0xffffd78b26694088:exe 11720 684 0 ------ 2019-12-26 08:06:54 UTC+0000
... 0xffffd78b1b420088:exe 4280 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
.... 0xffffd78b1abe90c8:exe 7032 4280 32768 ------ 2019-12-26 08:06:14 UTC+0000
... 0xffffd78b1b883088:e 4796 684 32768 ------ 2019-12-26 08:06:09 UTC+0000
... 0xffffd78b1ac700c8:exe 2244 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1b583088:exe 4556 684 0 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b1ab9a088:e.Serv 1236 684 32768 ------ 2019-12-26 08:06:05 UTC+0000

...

... 0xffffd78b1b8103c8.exe 4704 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffWARNING : volatility.debug : PID 4128 PPID 684 has already been seen
WARNING : volatility.debug : PID 2224 PPID 684 has already been seen
WARNING : volatility.debug : PID 1572 PPID 684 has already been seen
WARNING : volatility.debug : PID 2908 PPID 684 has already been seen
WARNING : volatility.debug : PID 13380 PPID 684 has already been seen
WARNING : volatility.debug : PID 2096 PPID 684 has already been seen
WARNING : volatility.debug : PID 3636 PPID 684 has already been seen
WARNING : volatility.debug : PID 4656 PPID 684 has already been seen
WARNING : volatility.debug : PID 4664 PPID 684 has already been seen
WARNING : volatility.debug : PID 9652 PPID 684 has already been seen
WARNING : volatility.debug : PID 8764 PPID 684 has already been seen
WARNING : volatility.debug : PID 3136 PPID 684 has already been seen
WARNING : volatility.debug : PID 1120 PPID 684 has already been seen
WARNING : volatility.debug : PID 8772 PPID 684 has already been seen
WARNING : volatility.debug : PID 3144 PPID 684 has already been seen
WARNING : volatility.debug : PID 12448 PPID 684 has already been seen
WARNING : volatility.debug : PID 2636 PPID 684 has already been seen
WARNING : volatility.debug : PID 2744 PPID 684 has already been seen
WARNING : volatility.debug : PID 13744 PPID 684 has already been seen
WARNING : volatility.debug : PID 2644 PPID 684 has already been seen
WARNING : volatility.debug : PID 5476 PPID 684 has already been seen
WARNING : volatility.debug : PID 1116 PPID 684 has already been seen
WARNING : volatility.debug : PID 12568 PPID 684 has already been seen
WARNING : volatility.debug : PID 4712 PPID 684 has already been seen
WARNING : volatility.debug : PID 2668 PPID 684 has already been seen
ffd78b1ad97088:exe 2524 684 0 ------ 2019-12-26 08:06:05 UTC+0000
... 0xffffd78b1c645088:exe 3920 684 0 ------ 2019-12-26 08:06:14 UTC+0000
... 0xffffd78b274d0088:e.exe 13280 684 32768 ------ 2019-12-26 08:09:12 UTC+0000
.... 0xffffd78b2669c308:exe 4624 13280 32768 ------ 2019-12-26 08:09:12 UTC+0000
... 0xffffd78b1b9d90c8:exe 5096 684 0 ------ 2019-12-26 08:06:09 UTC+0000
... 0xffffd78b1b2c5088:exe 4076 684 0 ------ 2019-12-26 08:06:08 UTC+0000
... 0xffffd78b26e80088: 2240 684 32768 ------ 2019-12-26 08:08:14 UTC+0000
... 0xffffd78b1b2aa088:exe 6648 684 0 ------ 2019-12-26 08:06:12 UTC+0000
... 0xffffd78b1b17c088:exe 3668 684 0 ------ 2019-12-26 08:06:07 UTC+0000
... 0xffffd78b24395088:exe 10928 684 0 ------ 2019-12-26 08:06:36 UTC+0000
... 0xffffd78b1b13d088:ileDev 4092 684 32768 ------ 2019-12-26 08:06:08 UTC+0000
.. 0xffffd78b18ca3088:e 692 612 0 ------ 2019-12-26 08:06:03 UTC+0000
.. 0xffffd78b18d59088st.ex 844 612 32768 ------ 2019-12-26 08:06:04 UTC+0000

... <rest of plist>

Time Stamp: Thu Dec 26 16:22:20 2019

******* End of command output ******

[David (PassMark)]

If the output from volatility is wrong, then there isn't much we can do about it. Workbench is just a GUI over the top of the command line version.

Except that we are working on a new release that uses Volatility V3 (the beta). So that might improve things.