SvcScan doesn't accurately distinguish between operating systems

[johnlabuyfoy1024]

volatility version = Volatility 3 Framework 1.0.0-beta.1
OS used to run Volatility = Linux kali 5.3.0-kali1-amd64 #1 SMP Debian 5.3.7-kali2 (2019-11-04) x86_64 GNU/Linux
Python version = Python 3.7.5
OS of target memory sample = Win10x64_17134
Command line = python3 vol.py -f /mnt/Labs/GBAKER-10L/data.lime windows.svcscan.SvcScan

Did not receive any output yet there are services that were running when memory image was acquired.
Output received:

Volatility 3 Framework 1.0.0-beta.1
Progress: 0.00 Scanning primary2 using PdbSignatureScanner
Offset Order Pid Start State Type Name Display Binary

[johnlabuyfoy1024]

sorry for the weird font & bolding - that was unintentional

[ikelos]

No problem on the formatting. 5;)

Can you please test whether other plugins return valid/appropriate results (such as windows.pslist)? In either circumstance, we'll probably need the output from vol.py -vvv which you can either attach or paste verbatim into the issues. It'd also be good to know whether you're using the released version or a git development commit (and if so, which one)?

Once we've got a bit more information we should be able to start narrowing in on what might be causing the issue... 5:)

[johnlabuyfoy1024]

Ok. Please see attached. .
volatility3-testing-11-18.txt

[ikelos]

Thanks, I've managed to recreate this with a similar windows version. It seems that the checks we had for "WinX_or_later" were in the wrong order, and the earliest windows was tested first. This should be resolved in commit 249c3ec2. Please could you test it and let us know if it all works?

[ikelos]

@iMHLv2 You might want to look into this further, if people are using symbols without metadata versioning, the fallback checks for is_win10_up_to_15063 and is_win10_16299_or_later are identical so we should probably try to locate another structural difference in the symbol tables between the two versions...

[johnlabuyfoy1024]

I installed the 249c3ec commit and it now works - see attached text file for output.
svcscan.txt

[ikelos]

Awesome, thanks for letting us know that fixed it. We'll leave the ticket open so @iMHLv2 can have a review of it and figure out if the solution is a permanent fix or needs more work... 5:)

[ikelos]

Ok, cool, looks like we can close this. Thanks everyone! 5:)