> vol.py imageinfo -f "winxp.raw"
Volatility Foundation Volatility Framework 2.3.1
Determining profile based on KDBG search...
Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
AS Layer1 : IA32PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (winxp.raw)
PAE type : No PAE
DTB : 0x39000L
KDBG : 0x8054c760
Number of Processors : 1
Image Type (Service Pack) : 2
KPCR for CPU 0 : 0xffdff000
KUSER_SHARED_DATA : 0xffdf0000
Image date and time : 2016-12-18 10:31:07 UTC+0000
Image local date and time : 2016-12-18 18:31:07 +0800
>vol.py hivelist --profile=WinXPSP3x86 -f "winxp.raw"
Volatility Foundation Volatility Framework 2.3.1
Virtual Physical Name
---------- ---------- ----
0xe1a29b60 0x0e579b60 \Device\HarddiskVolume1\Documents and Settings\test1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1a3e5e0 0x0e5b75e0 \Device\HarddiskVolume1\Documents and Settings\test1\NTUSER.DAT
0xe16be5e0 0x0c13d5e0 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe16f5008 0x0c278008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0xe1676378 0x0ba4e378 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe16d3b60 0x0c0e4b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0xe146c008 0x0acc5008 \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe146cb60 0x0acc5b60 \Device\HarddiskVolume1\WINDOWS\system32\config\default
0xe1391758 0x0ac3f758 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0xe146c6b8 0x0acc56b8 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0xe136c008 0x06f93008 [no name]
0xe1035b60 0x06c5ab60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe102e008 0x06c54008 [no name]
换了WIN764的，加入--profile=（系统版本）语句，就能hashdump那个hash值，但是用lsadump没直接出来密码。不知道是系统原因还是虚拟机的原因。原来的WinXPSP2x86在用lsadump时显示 Unable to read LSA secrets from registry ，应该是得不到LSA的信息。所以hash也出不来。原因不清楚。
