I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps.
I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm dumpguestcore --filename dump.vmem
I'm trying to build a tree of dll's imported by a process. Therefore I recursively walk the dll's starting at the process
ImageBaseAddress. The problem that occurs is that for some dll's the dllBase is paged and so I can't read the import and delay import directory structures.
I tried disabling the paging in
Control Panel ->
Virtual Memory ->
No paging file. I also changed the registy entry
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\DisablePagingExecutive from
1, but the behaviour stays the same.
Another Problem is that even if the dllBase is not paged, sometimes reading the import or delay import directories with PEfile fails although the module / dll has the directory.
Any help is most appreciated.