Windows Modules Not Returning Results

[jonpaulhemi]

Describe the bug
I was working on a CTF challenge with a Windows 10 memory dump. Some modules like windows.info worked, but most modules did not work. I checked out an older commit and it worked. The most recent working commit was on November 24, 2025 (a17281a).

Context
Volatility Version: 2.27.0
Operating System: Linux
Python Version: 3.12.3
Suspected Operating System: Windows 10 (From windows.info: Major/Minor 15.10240)
Command: vol -f /tmp/memdump.mem windows.pslist

To Reproduce
Steps to reproduce the behavior:

1. Use command vol -f /tmp/memdump.mem windows.*
2. Below, you can see expected behavior from November 24, 2025 commit versus example (failed) output from November 30, 2025 commit.

Expected behavior
Success should provide a list of processes from the memory dump, as shown here.
git checkout a17281a2145f5aa353fcccc35f09cfcd40ad0aa4
vol -vvvvv -f /tmp/memdump.mem windows.pslist

INFO     volatility3.cli: Volatility plugins path: ['/home/remnux/python-venvs/volatility3/volatility3/plugins', '/home/remnux/python-venvs/volatility3/volatility3/framework/plugins']
INFO     volatility3.cli: Volatility symbols path: ['/home/remnux/python-venvs/volatility3/volatility3/symbols', '/home/remnux/python-venvs/volatility3/volatility3/framework/symbols']
DEBUG    volatility3.plugins.yarascan: Using yara-python module
DEBUG    volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
Volatility 3 Framework 2.27.0
DETAIL 3 volatility3.cli: Cache directory used: /home/remnux/.cache/volatility3
INFO     volatility3.framework.automagic: Detected a windows category plugin
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
INFO     volatility3.framework.automagic: Running automagic: SymbolCacheMagic
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 3 volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler, LeechCoreHandler
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsIntelStacker
DEBUG    volatility3.framework.automagic.windows: Detecting Self-referential pointer for recent windows
DEBUG    volatility3.framework.automagic.windows: DtbSelfRef64bit test succeeded at 0x1aa000
DEBUG    volatility3.framework.automagic.windows: DTB was found at: 0x1aa000
DETAIL 2 volatility3.framework.automagic.stacker: Stacked IntelLayer using WindowsIntelStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DEBUG    volatility3.framework.automagic.stacker: physical_layer maximum_address: 1073602559
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility3.framework.automagic: Running automagic: KernelPDBScanner
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG    volatility3.framework.automagic.pdbscan: Kernel base determination - searching layer module list structure
DEBUG    volatility3.framework.automagic.pdbscan: Kernel base determination - searching layer module list structure
DEBUG    volatility3.framework.automagic.pdbscan: Setting kernel_virtual_offset to 0xf800aa67a000
DEBUG    volatility3.framework.symbols.windows.pdbutil: Using symbol library: ntkrnlmp.pdb/3C77A20382CE4024A425C6A53F4B167F-1
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility3.schemas: All validations will report success, even with malformed input
INFO     volatility3.framework.automagic: Running automagic: SymbolFinder    
INFO     volatility3.framework.automagic: Running automagic: KernelModule
DEBUG    volatility3.cli: Successfully constructed windows.pslist.PsList (3, 0, 1)
DETAIL 3 volatility3.cli.text_filter: Filters:
[]

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	File output
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ESILO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_CPU_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_IO_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_NET_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_NOTIFICATION_INFORMATION
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK

4	0	System	0xe0003d486840	115	-	N/A	False	2023-10-31 05:05:11.000000 UTC	N/A	Disabled
272	4	smss.exe	0xe0003e901040	2	-	N/A	False	2023-10-31 05:05:12.000000 UTC	N/A	Disabled
360	348	csrss.exe	0xe0003e99b600	9	-	0	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
424	348	wininit.exe	0xe0003d4aa080	1	-	0	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
432	416	csrss.exe	0xe0003e88d080	10	-	1	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
492	416	winlogon.exe	0xe0003d4f0080	4	-	1	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
540	424	services.exe	0xe0003edc4080	5	-	0	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
548	424	lsass.exe	0xe0003edca5c0	7	-	0	False	2023-10-31 05:05:13.000000 UTC	N/A	Disabled
636	540	svchost.exe	0xe0003ef1c080	16	-	0	False	2023-10-31 05:05:15.000000 UTC	N/A	Disabled
688	540	svchost.exe	0xe0003ef28080	9	-	0	False	2023-10-31 05:05:15.000000 UTC	N/A	Disabled
[TRUNCATED]

There were no additional debug messages after the final process in the above result.

Example output
The failed result does not list any processes, as shown here.
git checkout 493950c6346da816ef43a48afdf401cb326dc5de
vol -vvvvv -f /tmp/memdump.mem windows.pslist

INFO     volatility3.cli: Volatility plugins path: ['/home/remnux/python-venvs/volatility3/volatility3/plugins', '/home/remnux/python-venvs/volatility3/volatility3/framework/plugins']
INFO     volatility3.cli: Volatility symbols path: ['/home/remnux/python-venvs/volatility3/volatility3/symbols', '/home/remnux/python-venvs/volatility3/volatility3/framework/symbols']
DEBUG    volatility3.plugins.yarascan: Using yara-python module
DEBUG    volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
Volatility 3 Framework 2.27.0
DETAIL 3 volatility3.cli: Cache directory used: /home/remnux/.cache/volatility3
INFO     volatility3.framework.automagic: Detected a windows category plugin
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
INFO     volatility3.framework.automagic: Running automagic: SymbolCacheMagic
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 3 volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler, LeechCoreHandler
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsIntelStacker
DEBUG    volatility3.framework.automagic.windows: Detecting Self-referential pointer for recent windows
DEBUG    volatility3.framework.automagic.windows: DtbSelfRef64bit test succeeded at 0x1aa000
DEBUG    volatility3.framework.automagic.windows: DTB was found at: 0x1aa000
DETAIL 2 volatility3.framework.automagic.stacker: Stacked IntelLayer using WindowsIntelStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_virtual_offset requirements only accept int type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DETAIL 1 volatility3.framework.interfaces.configuration: TypeError - kernel_banner requirements only accept str type: None
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DEBUG    volatility3.framework.automagic.stacker: physical_layer maximum_address: 1073602559
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['IntelLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: WinSwapLayers
INFO     volatility3.framework.automagic: Running automagic: KernelPDBScanner
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG    volatility3.framework.automagic.pdbscan: Setting kernel_virtual_offset to 0xf800aa609000
DEBUG    volatility3.framework.symbols.windows.pdbutil: Using symbol library: ntkrnlmp.pdb/3C77A20382CE4024A425C6A53F4B167F-1
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility3.schemas: All validations will report success, even with malformed input
INFO     volatility3.framework.automagic: Running automagic: SymbolFinder    
INFO     volatility3.framework.automagic: Running automagic: KernelModule
DEBUG    volatility3.cli: Successfully constructed windows.pslist.PsList (3, 0, 1)
DETAIL 3 volatility3.cli.text_filter: Filters:
[]

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	File output
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_EPROCESS_QUOTA_BLOCK
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ESILO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_PAGEFAULT_HISTORY
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_ACCESS_STATE
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_CPU_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_IO_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_NET_RATE_CONTROL
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_JOB_NOTIFICATION_INFORMATION
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ACTIVATION_CONTEXT_DATA
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_FLS_CALLBACK_INFO
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_ASSEMBLY_STORAGE_MAP
DEBUG    volatility3.framework.symbols: Unresolved reference: symbol_table_name1!_SCSI_REQUEST_BLOCK

This is the full results. There are not any processes listed after the "Unresolved Reference" messaged.

Additional information

[arkfirefighter1]

This is the return I get when trying to work the NCL as well..

┌──(jpolacko㉿Home1KaliPurple)-[~/volatility3]
└─$ vol -vvvvv -f /home/jpolacko/volatility3/memdump.mem
INFO volatility3.cli: Volatility plugins path: ['/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/plugins', '/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins']
INFO volatility3.cli: Volatility symbols path: ['/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/symbols', '/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/symbols']
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.yarascan based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/cachedump.py", line 7, in
from volatility3.plugins.windows.registry import cachedump
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/cachedump.py", line 8, in
from Crypto.Cipher import ARC4, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.cachedump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/cachedump.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/indirect_system_calls.py", line 6, in
from volatility3.plugins.windows.malware import indirect_system_calls
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/indirect_system_calls.py", line 11, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.indirect_system_calls based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/indirect_system_calls.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/hashdump.py", line 7, in
from volatility3.plugins.windows.registry import hashdump
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/hashdump.py", line 10, in
from Crypto.Cipher import AES, ARC4, DES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.hashdump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/hashdump.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/vadyarascan.py", line 12, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.vadyarascan based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/vadyarascan.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/lsadump.py", line 7, in
from volatility3.plugins.windows.registry import lsadump
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/lsadump.py", line 9, in
from Crypto.Cipher import ARC4, DES, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.lsadump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/lsadump.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/direct_system_calls.py", line 7, in
from volatility3.plugins.windows.malware import direct_system_calls
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/direct_system_calls.py", line 13, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.direct_system_calls based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/direct_system_calls.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/mftscan.py", line 13, in
from volatility3.plugins import timeliner, yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.mftscan based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/mftscan.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/indirect_system_calls.py", line 11, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.malware.indirect_system_calls based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/indirect_system_calls.py
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/direct_system_calls.py", line 13, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.malware.direct_system_calls based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/malware/direct_system_calls.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/cachedump.py", line 8, in
from Crypto.Cipher import ARC4, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.registry.cachedump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/cachedump.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/hashdump.py", line 10, in
from Crypto.Cipher import AES, ARC4, DES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.registry.hashdump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/hashdump.py
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/lsadump.py", line 9, in
from Crypto.Cipher import ARC4, DES, AES
ModuleNotFoundError: No module named 'Crypto'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.windows.registry.lsadump based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/windows/registry/lsadump.py
DEBUG volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
INFO volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
DEBUG volatility3.framework: Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 19, in
import yara_x
ModuleNotFoundError: No module named 'yara_x'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/init.py", line 168, in import_file
importlib.import_module(module)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/importlib/init.py", line 88, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1387, in _gcd_import
File "", line 1360, in _find_and_load
File "", line 1331, in _find_and_load_unlocked
File "", line 935, in _load_unlocked
File "", line 1023, in exec_module
File "", line 488, in _call_with_frames_removed
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/linux/vmayarascan.py", line 11, in
from volatility3.plugins import yarascan
File "/home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/yarascan.py", line 25, in
import yara
ModuleNotFoundError: No module named 'yara'

DEBUG volatility3.framework: Failed to import module volatility3.plugins.linux.vmayarascan based on file: /home/jpolacko/.local/share/pipx/venvs/volatility3/lib/python3.13/site-packages/volatility3/framework/plugins/linux/vmayarascan.py
INFO volatility3.cli: The following plugins could not be loaded (use -vv to see why): volatility3.plugins.linux.vmayarascan, volatility3.plugins.windows.cachedump, volatility3.plugins.windows.direct_system_calls, volatility3.plugins.windows.hashdump, volatility3.plugins.windows.indirect_system_calls, volatility3.plugins.windows.lsadump, volatility3.plugins.windows.malware.direct_system_calls, volatility3.plugins.windows.malware.indirect_system_calls, volatility3.plugins.windows.mftscan, volatility3.plugins.windows.registry.cachedump, volatility3.plugins.windows.registry.hashdump, volatility3.plugins.windows.registry.lsadump, volatility3.plugins.windows.vadyarascan, volatility3.plugins.yarascan
Volatility 3 Framework 2.27.0
usage: vol [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND] [-p PLUGIN_DIRS]
[-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q] [-f FILE] [--write-config]
[--save-config SAVE_CONFIG] [--clear-cache] [--cache-path CACHE_PATH] [--offline | -u URL]
[--filters FILTERS] [--hide-columns [HIDE_COLUMNS ...]] [-r RENDERER]
[--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
[--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
PLUGIN ...
vol: error: Please select a plugin to run (see 'vol --help' for options

[ikelos]

@jonpaulhemi :
So the way the kernel pdb is calculated did change in commit 493950c6346da816ef43a48afdf401cb326dc5de and sure enough across the two runs, volatility identified the kernel as living at different locations:

0xf800aa67a000 - working (without #1902 )
0xf800aa609000 - not working (with #1902 )

This was merged as part of #1902 so I'll double check with @Abyss-W4tcher as to what the change was for and why it would solve #1889 but cause new errors on your image.

@arkfirefighter1 : Your issue is not the same, and the last line tells you clearly that you need to choose a plugin to run, and the command line you listed (vol -vvvvv -f /home/jpolacko/volatility3/memdump.mem) is only providing a filename and lacks any plugin. All the other errors in the output are because volatility3 wasn't fully installed and is missing some dependencies. Although those errors aren't critical and many plugins can still run, this can be resolved using pip install -e .[full]. Also, your issue is clearly different and not related to the above issue, please file a new ticket when discussing a new issue.

[arkfirefighter1]

Okay thank you. I've been running into different issue's trying to complete this NCL challenge.

[ikelos]

@Abyss-W4tcher I'm not sure I understand how this is breaking, because with the patch, it should only be creating a higher possible kernel, but with #1902 is apparently thinks it found a lower address for the kernel? 5:S

[ikelos]

Also interesting, in the working version we get two additional debug lines, which aren't there after the patch goes in? 5:S

DEBUG    volatility3.framework.automagic.pdbscan: Kernel base determination - searching layer module list structure
DEBUG    volatility3.framework.automagic.pdbscan: Kernel base determination - searching layer module list structure

[Abyss-W4tcher]

Hi I've investigated this, and the breaking point from what I see is this commit:

9d67420

If I checkout the commit right before it it still works, after this it doesn't. With this commit the DTB is ignored:

DEBUG    volatility3.framework.automagic.windows: DTB 1aa000 contains less than 12 valid pointers, ignoring

@ikelos I see that there is a new check here:

9d67420#diff-95515258a22a0ced4292d19bfd7dd395e507e8a7f9925efb6c4ec4207b00dd41R314

but I'm not sure to understand why the check is done byte-per-byte and not per pointer like get_max_pointer?

---

Sample is at https://cybertalents.com/challenges/forensics/invisible

[Abyss-W4tcher]

I've updated the check and it seems to fix the issue, however I'm not sure that it doesn't break #1929. Could you check this against the "dummy page table" samples please?

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index af5d4809..5478a57b 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -153,7 +153,8 @@ class DtbSelfRefPae(DtbSelfReferential):
             # Mask off the page bits of top level page map
             page_table_mask = b"\x00\xf0\xff\xff\xff\xff\xff\xff" * 4
             page_table = data[
-                top_pae_page - data_offset : top_pae_page
+                top_pae_page
+                - data_offset : top_pae_page
                 - data_offset
                 + (4 * self.ptr_size)
             ]
@@ -286,22 +287,35 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
                 """Key used to sort by tests"""
                 return tests.index(x[0]), x[1]
 
-            def get_max_pointer(page_table, test, ptr_size: int):
-                """Determines a pointer from a page_table"""
-                max_ptr = 0
+            def get_valid_page_table_pointers(page_table, ptr_size: int):
                 for index in range(0, len(page_table), ptr_size):
                     pointer = struct.unpack(
                         test.ptr_struct, page_table[index : index + ptr_size]
                     )[0]
                     # Make sure the pointer is valid, ignore large pages which would require more calculation
                     if pointer & 0x1 and not pointer & 0x80:
-                        max_ptr = max(
-                            max_ptr,
-                            (pointer ^ (pointer & 0xFFF))
-                            % test.layer_type.maximum_address,
-                        )
+                        yield pointer
+
+            def get_max_pointer(page_table, test, ptr_size: int):
+                """Determines a pointer from a page_table"""
+                max_ptr = 0
+                for pointer in get_valid_page_table_pointers(page_table, ptr_size):
+                    max_ptr = max(
+                        max_ptr,
+                        (pointer ^ (pointer & 0xFFF)) % test.layer_type.maximum_address,
+                    )
                 return max_ptr
 
+            def page_table_is_dummy(page_table, ptr_size):
+                valid_pointers = 0
+                for _ in get_valid_page_table_pointers(page_table, ptr_size):
+                    valid_pointers += 1
+                    if valid_pointers >= 12:
+                        # Do not consume the entire generator to enhance performance
+                        return False
+
+                return True
+
             hits = sorted(list(hits), key=sort_by_tests)
 
             vollog.debug(f"WindowsIntelStacker hits: {hits}")
@@ -309,16 +323,15 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
             for test, page_map_offset in hits:
                 # Turn the page tables into integers and find the largest one
                 page_table = base_layer.read(page_map_offset, 0x1000)
+                ptr_size = struct.calcsize(test.ptr_struct)
 
                 # Modern windows can have a dummy page table with only about 2 entries, so sanity check
-                null_count = sum([1 if page_table[x] else 0 for x in page_table])
-                if null_count > 0xFA0:
+                if page_table_is_dummy(page_table, ptr_size):
                     vollog.debug(
                         f"DTB {page_map_offset:x} contains less than 12 valid pointers, ignoring"
                     )
                     continue
 
-                ptr_size = struct.calcsize(test.ptr_struct)
                 max_pointer = get_max_pointer(page_table, test, ptr_size)
 
                 if max_pointer <= base_layer.maximum_address:

[ikelos]

I'm not sure I have access to the original sample anymore (I was asked to delete it after use). That code should also only be used for the DTB and across the two samples, but in the report, both DTBs were the same?

DEBUG    volatility3.framework.automagic.windows: DTB was found at: 0x1aa000 - working
DEBUG    volatility3.framework.automagic.windows: DTB was found at: 0x1aa000 - not working

Also, the image that you linked seems to work fine on develop?

Volatility 3 Framework 2.28.0
Progress:  100.00		PDB scanning finished                                                                                              
PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	File output

4	0	System	0xe0005e77c780	114	-	N/A	False	2022-07-06 21:53:20.000000 UTC	N/A	Disabled
268	4	smss.exe	0xe0005fd65040	2	-	N/A	False	2022-07-06 21:53:20.000000 UTC	N/A	Disabled
344	336	csrss.exe	0xe000613673c0	9	-	0	False	2022-07-06 21:53:25.000000 UTC	N/A	Disabled
404	336	wininit.exe	0xe0005e781080	1	-	0	False	2022-07-06 21:53:25.000000 UTC	N/A	Disabled
412	396	csrss.exe	0xe0005fa56080	10	-	1	False	2022-07-06 21:53:25.000000 UTC	N/A	Disabled
460	396	winlogon.exe	0xe0005e7aa080	5	-	1	False	2022-07-06 21:53:25.000000 UTC	N/A	Disabled
484	404	services.exe	0xe00061d32080	6	-	0	False	2022-07-06 21:53:25.000000 UTC	N/A	Disabled
...

The commit you posted to wasn't on develop directly, it was under a branch. I'd always assumed git bisect dealt with that, but I'd have thought it would should a commit directly in the path of develop, rather than down a branch...

As to the test, I'm happy to get it improved, the byte count I did was shoddy and was done for speed, but I haven't reviewed the patch you posted. If you can submit it as a PR I'll go through it, but I've no issue improving the check in theory. 0xFA0 was just to allow for some pointers but not many, it's absolutely arbitrary (as is the number 12, I plucked it out of thin air). 5;P I'm happy to live with it until it proves inaccurate though (could probably do with a comment string to point out that it's inaccurate). 5:)

[Abyss-W4tcher]

Weird, it's not working for me on develop, without the proposed patch:

$ git rev-parse HEAD
ba466f8064dff5d984d60114fccb617efb93e60c
$ python3 vol.py -f memdump.mem -r pretty windows.pslist
Volatility 3 Framework 2.28.0
Progress:  100.00               PDB scanning finished                  
Unsatisfied requirement plugins.PsList.kernel.layer_name: 
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

This can be difficult to ensure my patch doesn't reintroduce the very bug fixed by #1929 without the sample. Sure I can submit a PR but it might not even be relevant so that's why I pushed an integrated diff first.

[ikelos]

Oh, yep, my bad, I'd been testing out your patch! So, it does fail without, but... I don't understand why? At least I can investigate what's different between the two now... 5:S

[Abyss-W4tcher]

The current implementation counts the number of \x00 in the page table, but valid pointers can contain \x00 so it was artificially increasing the "bad count" value.

[ikelos]

Ok, so with full logging, we do get messages about the DTB being skipped:

DTB 1aa000 contains less than 12 valid pointers, ignoring

And then it never actually finds a DTB, so there is no intel layer. Which means your patch does resolve a problem with an issue that existed... It just doesn't look like it's the same issue that's been reported here by @jonpaulhemi.

I'd suggest submitting a PR, because it does look cleaner that what I cobbled together. Actually looking for 12 entries (rather than just counting bytes) means that we don't get more than we should (from pages like 0x000000800000, which only class as one byte out of 0xFA0, but classes as a whole pointer out of 12.

[ikelos]

Sure, but that doesn't explain the original logs which indicated the same DTB was used to construct the intel layer. So as I say, I think you solved a valid problem, just not the one by the original poster. We'll need his input to figure out what's actually going on in his circumstance.

[Abyss-W4tcher]

Author says:

This is the full results. There are not any processes listed after the "Unresolved Reference" messaged.

But:

# low stub fix commit
git checkout 493950c6346da816ef43a48afdf401cb326dc5de
vol -vvvvv -f /tmp/memdump.mem windows.pslist

on my end yields valid processes? I don't see any issue introduced by the low stub fix commit, if I checkout before or after it analysis works fine.