{"action":"created","issue":{"url":"https://api.github.com/repos/google/rekall/issues/109","labels_url":"https://api.github.com/repos/google/rekall/issues/109/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/109/comments","events_url":"https://api.github.com/repos/google/rekall/issues/109/events","html_url":"https://github.com/google/rekall/issues/109","id":123436365,"number":109,"title":"live plugin returns unsupported architecture for x86","user":{"login":"dsweet04","id":5368247,"avatar_url":"https://avatars.githubusercontent.com/u/5368247?v=3","gravatar_id":"","url":"https://api.github.com/users/dsweet04","html_url":"https://github.com/dsweet04","followers_url":"https://api.github.com/users/dsweet04/followers","following_url":"https://api.github.com/users/dsweet04/following{/other_user}","gists_url":"https://api.github.com/users/dsweet04/gists{/gist_id}","starred_url":"https://api.github.com/users/dsweet04/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsweet04/subscriptions","organizations_url":"https://api.github.com/users/dsweet04/orgs","repos_url":"https://api.github.com/users/dsweet04/repos","events_url":"https://api.github.com/users/dsweet04/events{/privacy}","received_events_url":"https://api.github.com/users/dsweet04/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-12-22T08:13:13Z","updated_at":"2016-01-05T20:46:30Z","closed_at":null,"body":"I've tested against both 2003 and 2008 32bit server images on EC2 after installing the Rekall_1.4.1_Etzel_x86 binary. running command prompt as administrator I get back \"rekall.plugin.PluginError: Unsupported architecture\" for both.\r\n\r\nC:\\Program Files\\Rekall>rekal.exe -v --live pslist\r\nDEBUG:rekall.1:Unable to open \\\\.\\pmem: (2, 'CreateFile', 'The system cannot find the file specified.')\r\nTraceback (most recent call last):\r\n File \"<string>\", line 7, in <module>\r\n File \"C:\\Users\\mic\\rekall\\build\\rekal\\out00-PYZ.pyz\\rekall.rekal\", line 104, i\r\nn main\r\n File \"C:\\Users\\mic\\rekall\\build\\rekal\\out00-PYZ.pyz\\rekall.args\", line 397, in\r\nparse_args\r\n File \"C:\\Users\\mic\\rekall\\build\\rekal\\out00-PYZ.pyz\\rekall.rekal\", line 99, in\r\nglobal_arg_cb\r\n File \"C:\\Users\\mic\\rekall\\build\\rekal\\out00-PYZ.pyz\\rekall.plugins.tools.live_\r\nwindows\", line 161, in live\r\n File \"C:\\Users\\mic\\rekall\\build\\rekal\\out00-PYZ.pyz\\rekall.plugins.tools.live_\r\nwindows\", line 96, in load_driver\r\nrekall.plugin.PluginError: Unsupported architecture"},"comment":{"url":"https://api.github.com/repos/google/rekall/issues/comments/169128150","html_url":"https://github.com/google/rekall/issues/109#issuecomment-169128150","issue_url":"https://api.github.com/repos/google/rekall/issues/109","id":169128150,"user":{"login":"scudette","id":3856546,"avatar_url":"https://avatars.githubusercontent.com/u/3856546?v=3","gravatar_id":"","url":"https://api.github.com/users/scudette","html_url":"https://github.com/scudette","followers_url":"https://api.github.com/users/scudette/followers","following_url":"https://api.github.com/users/scudette/following{/other_user}","gists_url":"https://api.github.com/users/scudette/gists{/gist_id}","starred_url":"https://api.github.com/users/scudette/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scudette/subscriptions","organizations_url":"https://api.github.com/users/scudette/orgs","repos_url":"https://api.github.com/users/scudette/repos","events_url":"https://api.github.com/users/scudette/events{/privacy}","received_events_url":"https://api.github.com/users/scudette/received_events","type":"User","site_admin":false},"created_at":"2016-01-05T20:46:30Z","updated_at":"2016-01-05T20:46:30Z","body":"On windows you can set the evironment variable for just one command (see http://superuser.com/questions/223104/setting-environment-variable-for-just-one-command-in-windows-cmd-exe):\r\n\r\n```\r\ncmd.exe /c \"set PROCESSOR_ARCHITEW6432=I386 && \"c:\\Program Files\\Rekall\\rekal.exe --live pslist\"\r\n```\r\n\r\nYou can also build a windows binary from the latest github head as described here (This bug is fixed in master branch): http://rekall-forensic.blogspot.ch/2015/09/installing-rekall-on-windows.html"}}