Windows 11

[DFI-SheepDog]

Volatility 3 Framework 2.26.2
Progress: 100.00 PDB scanning finished
Unsatisfied requirement plugins.Info.kernel.layer_name:
Unsatisfied requirement plugins.Info.kernel.symbol_table_name:

A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled. Please verify that:
The associated translation layer requirement was fulfilled
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.Info.kernel.layer_name', 'plugins.Info.kernel.symbol_table_name']

Any Assistance would be appreciated. Windows 11 Profile.

[Carryouu]

Hello,
were you able to find a solution ? For me it worked but it might be because it wasn t the last build of windows 11 even it still a windows 11.
Let me know if it worked for you :)
thanks a lot in advance.
Best regards,
Mehdi.

[Tylereck81]

Hello,

I am currently doing a project with windows 11 live kernel dumps. I am running into the same problem. Have you found a solution?

• Tyler

[ikelos]

For people having difficulty with certain Windows 11 images, there is now a pull request in testing to try to resolve the issue. If you know how, we'd much appreciate people testing the #1929 pull request and letting us know whether it now improves the situation.

For a more detailed reason as to why this works, a heuristic was used to find the "map" that explains how the memory is laid out. In windows, one particular part of that map always points to itself, and we used this fact to quickly identify it. The map also always tended to live in a particular location. Some recent images have shown that Microsoft now stores the map in a location that can fall outside the area we were previously checking, and there can now be a false map which points to itself, but contains next to no other entries, right where we'd expect the real map to be. For this reason, volatility was detecting that map and trying to use it, which led to it being unable to detect Windows on those images.

The new patch improves the heuristic by expanding the search area significantly and improving the verification of the map to rule out maps with a very small number of entries (likely too few to support a running system). We may still be able to make improvements on this, but we'd need people with images that failed to run the patched version of volatility (available as #1929) with the debug flags -vvvvvvv and report the hex offset of the DTB value that was found (and whether windows 11 was successfully identified). With enough samples we can minimize the areas we need to examine on new images.

So please could anyone experiencing issues with a Windows 11 image and volatility 3 test this pull request if you're able, and report back whether it works (and if possible the identified DTB value as found in the -vvvvvvv output).