Hello, Currently, symbols are only pulled from the kernel (vmlinux) so none of the symbol addresses of modules will be directly available via the API. It is a future goal of Volatility to support these symbols as well. In the meantime, you can use readelf or objdump on the bluetooth .ko file to get the offset of the symbol from the .data section and then you can use linux_lsmod with -S to find the .data section of the bluetooth kernel module in memory then simply add the address + offset to determine where the symbol is in the memory image. On Sun, Apr 14, 2013 at 11:27 AM, Pranjal Jumde <pranjal.jumde(a)gmail.com> wrote: the

Hi Pranjal, as promised, I've now released a plugin that wraps up pdbparse and so allows Windows symbol lookups. Symbol files are automatically downloaded upon demand and stored within the Volatility cache directories. As all testing has currently been on OS X and Ubuntu boxes, (ironically) there may be issues in using the code within a Windows environment! In the end, I didn't rework the name undecoration code (phew!). However, to avoid a possible segmentation fault, you currently need to apply a small patch when building pdbparse. FYI, undecoration doesn't process exported strings (though this shouldn't be hard to do as these are currently recognised, but not decoded) and there's a small number of (template?) related function names that do not get undecorated (this is in common with Wine's undname.c code - pdbparse's src/undname.c is based on the same code). Details of the (minor) pdbparse patch are here: https://code.google.com/p/pdbparse/issues/detail?id=13 and the plugin code is here: https://github.com/carlpulley/volatility/blob/master/symbols.py Despite nomenclature, the idea is not to really use this code as a plugin! Either: extend the plugin (and so get access to its lookup method); or create an instance of the plugin's class and then call calculate (which will allow lookup to then be initialised and usable). Hope that helps, Carl. _______________________________________________ Vol-dev mailing list Vol-dev(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev