Hello Experts,
I am a newbie at Memory Forensics, I have only played around with memory dumps 1 or 2 times. I have been watching some of 13Cubed videos on YT, in the Detecting Persistence in Memory video https://
From Kali, I downloaded a copy of Winesap and copied all the .py files to path /usr/lib/python2.7/dist-packages/volatility/plugins. As suggested in 13Cubed video, i renamed the class "Autorun2". When I run volatility -h the newer autorun2 is listed as a plugin immediately after the original autorun plugin.
However, for all the other .py files that I copied over I get…
Volatility Foundation Volatility Framework 2.6
Failed to import volatility.plugins.installed_components (ImportError No module named _winreg)
Failed to import volatility.plugins.startup (ImportError No module named _winreg)
Failed to import volatility.plugins.image_file_exec_options (ImportError No module named _winreg)
Failed to import volatility.plugins.appinit_dlls (ImportError No module named _winreg)
Failed to import volatility.plugins.winlogon (ImportError No module named _winreg)
Failed to import volatility.plugins.service (ImportError No module named _winreg)
Failed to import volatility.plugins.winutils (ImportError No module named _winreg)
Failed to import volatility.plugins.scheduled_task (ImportError No module named _winreg)
Failed to import volatility.plugins.shortcuts (ImportError No module named _winreg)
Failed to import volatility.plugins.active_setup (ImportError No module named _winreg)
*** Failed to import volatility.plugins.run_keys (ImportError No module named _winreg)
The winutils.py file import winreg, then all the other files import winutils.
The volatility folder does NOT contain a winreg.py file, from my research it has to do with accessing Windows Registry but I can not find winreg.py anywhere online.
Where are the Volatility Gurus?
I thought this place was full of Experts…
Where are the Volatility Gurus?
I thought this place was full of Experts…
They are probably on vacation.
Have you actually installed the Windows libraries?
https://
###Dependencies
pip install pywin32 in order to work with Windows registers.
winreg should be however in the "default" install of python.
It changed name between 2 and 3 , so ther may be issues with the environment
https://
BUT AFAIK it is on Windows only
https://
jaclaz