Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Question: Python volatility3 plugin does not work when VM is paused #248

@dommi22m

Description

@dommi22m

Hi!

I hope it's okay that I'm asking a question here.

I would like to perform several Volatility3 queries in succession for a certain state of a VM. To do this, I pause the VM in advance. If I now execute Volatility with the following command, for example, it simply stops.
vol --plugin-dirs /home/user/libmicrovmi/python/microvmi/volatility/ --single-location "vmi:///?vm_name=windows10&kvm_unix_socket=/tmp/introspector" windows.pslist.PsList
If I now unpause the VM, Volatility continues to run and also outputs the required information.

So the plugin does not seem to work when the VM is paused. What I don't quite understand is that I have already rewritten the plugin once so that the VM is automatically paused and it works. (See here #246)
Is there a technical background that I don't understand or does anyone have a tip for me on how I could solve the problem?

Underlying hypervisor: KVM

Thank you already!
Tommy

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions