Joe,
How did I manage to miss the –info option? <face-slap> In any case, I just tried that (with the only linux profile listed by –info, Linuxold_Debian2632x86) , and it gives me:
root@SIFT-Workstation:~/Desktop/linux_Volatility/linux-trunk# python ./vol.py -f /dev/pmem linux_pslist
Volatile Systems Volatility Framework 2.2_alpha
No suitable address space mapping found
Tried to open image as:
LimeAddressSpace: lime: need base
ArmAddressSpace: No base Address Space
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
AMD64PagedMemory: No base Address Space
JKIA32PagedMemory: No base Address Space
JKIA32PagedMemoryPae: No base Address Space
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
LimeAddressSpace: Invalid Lime header signature
ArmAddressSpace: No valid DTB found
WindowsHiberFileSpace32: No xpress signature found
WindowsCrashDumpSpace64: Header signature invalid
WindowsCrashDumpSpace32: Header signature invalid
AMD64PagedMemory: Incompatible profile WinXPSP2x86 selected
JKIA32PagedMemory: No valid DTB found
JKIA32PagedMemoryPae: No valid DTB found
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
FileAddressSpace: Must be first Address Space
Thoughts?
John
From: Joe Sylve [mailto:joe.sylve@gmail.com]
Sent: Friday, August 10, 2012 3:10 PM
To: McCash John-GKJN37
Cc: Jamie Levy; vol-dev@volatilityfoundation.org
Subject: Re: [Vol-dev] RE: Problem with Linux Volatility
Hey John,
Sorry for the delayed response. I'm just getting back from DFRWS.
The linux-trunk version works fine. Just remember there are different commands associated with Linux images than there are for windows. Do something like python vol.py --info and it'll give you a list of available profiles (generated from the zip you put in the overlays folder).
then do: python vol.py --profile=Linuxwhatever -f ../file.lime -h
This will list commands you can run on the images. They'll be like linux_pslist instead of pslist for example.
Hope this helps.
--
Joe Sylve, M.S.
Senior Security Researcher
GIAC Certified Forensics Analyst (GCFA)
Digital Forensics Solutions, LLC
http://www.digitalforensicssolutions.com/
On Fri, Aug 10, 2012 at 3:01 PM, McCash John-GKJN37 <john.mccash@motorolasolutions.com> wrote:
Jamie,
I can't get the linux-trunk branch to work with a LiME dump or /dev/pmem either. It also looks somewhat different. There, I'm not even sure how to specify the profile file, and rather than Linux32 or Linux64 profiles, the only one that seems to be defined is AbstractLinuxProfile. I even tried dropping in my zipped profile file to replace the existing Debian2632.zip, but that didn't help either. Maybe I'm just not cut out for using prerelease software and should sit back and wait for the 2.2 release candidate.
Thanks
John
-----Original Message-----
From: Jamie Levy [mailto:jamie.levy@gmail.com]
Sent: Friday, August 10, 2012 10:58 AM
To: McCash John-GKJN37
Cc: vol-dev@volatilityfoundation.org
Subject: Re: [Vol-dev] RE: Problem with Linux Volatility
Have you tried using the "linux-trunk" branch instead of scudette's branch? I think the wiki might need to be updated as well.
(svn checkout https://volatility.googlecode.com/svn/branches/linux-trunk
linux-trunk)
On Fri, Aug 10, 2012 at 11:47 AM, McCash John-GKJN37 <john.mccash@motorolasolutions.com> wrote:
> Response anyone? I can't believe this would really be this broken, so> I have to be doing something wrong (or maybe not... see below). I first
> tried this with r2149, and have checked a couple of the more recent
> updates, I but get the same result. Are the wiki instructions I'm following maybe out-of-date?
>
>
>
>
>
> Looking further, I tried this with -dubug, and got:
>
>
>
> ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer
>
>>
>> /home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility
>> /plugins/addrspaces/mmap_address_space.py(67)__init__()
>
> -> access=mmap.ACCESS_READ)
>
>
>
> Then looked at line 67 in mmap_address_space.py, and see:
>
>
>
> # On 64 bit architectures we can just map the entire image
>
> # into our process. TODO(scudette): Try to make this work on
>
> # 32 bit systems by segmenting into several smallish maps.
>
> self.map = mmap.mmap(self.fhandle.fileno(), self.fsize,
>
> access=mmap.ACCESS_READ)
>
>
>
> So, assuming the above TODO comment related to the issue I'm seeing;
> Is it because I'm running volatility on a 32bit system, or because I'm
> trying to analyze a dump from a 32bit system?
>
> Thanks
>
> John
>
>
>
> From: McCash John-GKJN37
> Sent: Tuesday, August 07, 2012 2:12 PM
> To: 'vol-dev@volatilityfoundation.org'
> Subject: Problem with Linux Volatility
>
>
>
> Hi Folks,
>
> Sorry you only seem to hear from me about once a year,
> but I got fired up over Joe's & Andrew's Forensic Summit presentations
> and resolved to try out the new stuff in the Linux & Mac branches.
> Unfortunately I don't seem to have gotten very far with it. I've got
> the scudette branch installed on a SIFT Kit VM, and have successfully
> used LiME to dump memory from it. I've also successfully created a
> profile for the SIFT Kit's 2.6.31-23-generic kernel, using json I
> successfully dumped from module_dwarf.ko. I even tried the live
> /dev/pmem memory interface you get when you load up the pmem.ko> module. When I attempt to run Volatility , here's what happens...
>
>
>
>
>
> root@SIFT-Workstation:~/Desktop/linux_Volatility/lin64-support# python
> vol.py
>
>
>
> The Volatility Memory Forensic Framework technology preview (3.0_tp1).
>
>
>
> NOTE: This is pre-release software and is provided for evauation only.
> Please
>
> check at http://volatility.googlecode.com/ for officially supported
> versions.
>
>
>
> This program is free software; you can redistribute it and/or modify
> it under
>
> the terms of the GNU General Public License.
>
>
>
>>>> session.filename = "/dev/pmem"
>
>>>> session.profile_file = "myprofile.zip"
>
>>>> session.profile = "Linux32"
>
>>>> vol (plugins.pslist)
>
> ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer
>
> ERROR:root:Fatal Error: cannot fit 'long' into an index-sized integer
>
> ERROR:root:Failed running plugin pslist: kernel_address_space not specified.
>
> ERROR:root:Error: 'NoneType' object has no attribute 'name'
>
> Traceback (most recent call last):
>
> File "<console>", line 1, in <module>
>
> File
> "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility
> /session.py",
> line 292, in vol
>
> self.last = super(InteractiveSession, self).vol(*args, **kwargs)
>
> File
> "/home/sansforensics/Desktop/linux_Volatility/lin64-support/volatility
> /session.py",
> line 154, in vol
>
> ui_renderer.start(plugin_name=result.name, kwargs=kwargs)
>
> AttributeError: 'NoneType' object has no attribute 'name'
>
>>>>
>
>
>
> Am I doing something brain-damaged?
>
> Thanks
>
> John
>
>
>
>
> _______________________________________________
> Vol-dev mailing list
> Vol-dev@volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
>
--
PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92
_______________________________________________
Vol-dev mailing list
Vol-dev@volatilesystems.com
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
_______________________________________________
Vol-dev mailing list
Vol-dev@volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev