autoruns.py error about volatility-autoruns

[tomchop]

Looks like you're using an old version of the plugin. Can you git pull and tell me if you still run into the problem?

[dnice77]

Hi Thomas, I did in fact do a git pull and still getting the error. Thanks for the follow up.

On Thu, May 11, 2017 at 11:07 AM Thomas Chopitea ***@***.***> wrote: Looks like you're using an old version of the plugin. Can you git pull and tell me if you still run into the problem? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AK3hugCCD0qYJXmoUURRBpjrAvRLsFC2ks5r4yQngaJpZM4NPdDb> .

-- Sincerely, Darrell Bohatec

[tomchop]

Cool, closing this out then. Thanks!

[dnice77]

My apologies, issue is still occurring following the git pull...

On Thu, May 11, 2017 at 11:12 AM Thomas Chopitea ***@***.***> wrote: Cool, closing this out then. Thanks! — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AK3huiB-KFGnsKUx-uOWbnQtfcBkC_UVks5r4yV1gaJpZM4NPdDb> .

-- Sincerely, Darrell Bohatec

[tomchop]

Is it the same function that's giving you trouble?

[dnice77]

Yep!

On Thu, May 11, 2017 at 11:32 AM Thomas Chopitea ***@***.***> wrote: Is it the same function that's giving you trouble? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AK3huhKy_QGvgMbxm5YGhSAiRqud0fiKks5r4yolgaJpZM4NPdDb> .

-- Sincerely, Darrell Bohatec

[tomchop]

Weird, the check on None is made in https://github.com/tomchop/volatility-autoruns/blob/master/autoruns.py#L246. Can you print the stacktrace here please?

[dnice77]

*** Failed to import volatility.plugins.VolDiff (ImportError: No module named simplejson)
Traceback (most recent call last):
File "/usr/local/bin/vol.py", line 192, in
main()
File "/usr/local/bin/vol.py", line 183, in main
command.execute()
File "/usr/local/Cellar/volatility/2.6/libexec/lib/python2.7/site-packages/volatility/commands.py", line 120, in execute
data = self.calculate()
File "/usr/local/Cellar/volatility/2.6/libexec/lib/python2.7/site-packages/volatility/plugins/autoruns.py", line 519, in calculate
self.services = self.get_services()
File "/usr/local/Cellar/volatility/2.6/libexec/lib/python2.7/site-packages/volatility/plugins/autoruns.py", line 309, in get_services
service = self.parse_service_key(service)
File "/usr/local/Cellar/volatility/2.6/libexec/lib/python2.7/site-packages/volatility/plugins/autoruns.py", line 287, in parse_service_key
entry = entry.replace('\x00', '')
AttributeError: 'NoneType' object has no attribute 'replace'

[dnice77]

Hey Thomas,

Any resolution or feedback on this issue?

[tomchop]

So double-checking it seems that the line numbers don't correspond to the actual code in the repo. Are you sure you're using the most recent version of the plugin?

[dnice77]

I have just did a pull from your repo and overwrote the existing autoruns.py script...running the command against a Win7SP1x64 image and it worked. I realized the plugin was pulled from the community site of previous plugin winners. Appreciate you checking back with me...

[dnice77]

Good to close

[tomchop]

NP!