Test the noprod environment failed

[Minvinea]

Hello,

I'm trying to test VolWeb in a noprod environment.
Webapp started sucessfull, i create a case, add a dump but analysis of dump failed. I tryed to restart but don't works with status "Unsatisfied requirements".

Logs, after "Restart analysis", i seen message "Unsatisfied requirements" but i dont know which requirements miss.

volweb-frontend    | 192.168.1.73 - - [27/Jan/2025:22:53:11 +0000] "POST /api/evidence/tasks/restart/ HTTP/1.1" 200 0 "http://192.168.1.57:3000/evidences" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0" "-"
volweb-workers     | [2025-01-27 22:53:11,307: INFO/ForkPoolWorker-2] Starting extraction
volweb-workers     | [2025-01-27 22:53:11,309: INFO/ForkPoolWorker-2] Detected a windows category plugin
volweb-workers     | [2025-01-27 22:53:11,310: INFO/ForkPoolWorker-2] Running automagic: ConstructionMagic
volweb-workers     | [2025-01-27 22:53:11,319: INFO/ForkPoolWorker-2] Running automagic: SymbolCacheMagic
volweb-workers     | [2025-01-27 22:53:11,329: INFO/ForkPoolWorker-2] Running automagic: LayerStacker
volweb-workers     | [2025-01-27 22:53:15,156: INFO/ForkPoolWorker-2] Running automagic: WinSwapLayers
volweb-workers     | [2025-01-27 22:53:15,156: INFO/ForkPoolWorker-2] Running automagic: KernelPDBScanner
volweb-workers     | [2025-01-27 22:53:15,156: INFO/ForkPoolWorker-2] No suitable kernels found during pdbscan
volweb-workers     | [2025-01-27 22:53:15,157: INFO/ForkPoolWorker-2] Running automagic: SymbolFinder
volweb-workers     | [2025-01-27 22:53:15,157: INFO/ForkPoolWorker-2] Running automagic: KernelModule
volweb-workers     | [2025-01-27 22:53:15,171: WARNING/ForkPoolWorker-2] Unsatisfied requirements:
volweb-workers     | [2025-01-27 22:53:15,176: INFO/ForkPoolWorker-2] Task Windows.Engine[d5dfcfb5-1b67-45bc-9023-4d7612ec743a] succeeded in 3.898149948000082s: None

Can you help me to try use your tool?

[k1nd0ne]

Hello @Minvinea,

Thank you for your interest to this project.

A couple of questions :

• Does your noprod env has access to the internet ? Volatility3 will need to fetch the debugging symbols and create the ISF using the debugging symbols from microsoft website.
• Have you tried running a plugin on your dump from the volatility3 framework CLI first ?

[Minvinea]

Hello,

Yes, my server and indirectly noprod env with docker access.
I tryed to get info of my memory dump (windows.info.Info) of my file and i have an error on my server and with my forensic host.

deb12:~# vol -f /home/user/vm-win11-forensic-Snapshot2.vmem windows.info.Info
Volatility 3 Framework 2.11.0
WARNING  volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. vm-win11-forensic-Snapshot2.vmem and vm-win11-forensic-Snapshot2.vmss.
Progress:  100.00               PDB scanning finished
Unsatisfied requirement plugins.Info.kernel.layer_name:
Unsatisfied requirement plugins.Info.kernel.symbol_table_name:

A translation layer requirement was not fulfilled.  Please verify that:
        A file was provided to create this layer (by -f, --single-location or by config)
        The file exists and is readable
        The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled.  Please verify that:
        The associated translation layer requirement was fulfilled
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.Info.kernel.layer_name', 'plugins.Info.kernel.symbol_table_name']

This is my error. You know this error? It seems provide from my install with "pip3" manager.

If you have an idea ?

[k1nd0ne]

Yeap, this seems to be an issue regarding volatility3 rather than VolWeb. You should open an issue on the volatility3's github page.

In the issue please be sure to include the following the output of the command: vol -vvvv -f /home/user/vm-win11-forensic-Snapshot2.vmem windows.info.Info

It will help the core dev figuring out what's going on.

Kind regards,

[Minvinea]

Thank you for your quick return.

I will postpone my bug.

Look forward to trying your tool.