Hi Folks,
Thanks tons to Mike Auty, Andrew Case, Joe Sylve, Andrew DiMino, Michael
Cohen, and Jamie Levy, I'm now up and running with Volatility for Linux. I did want to
mention a couple of things that I ran into problems with. It's possible we might want
for some related items to be more prominent in the documentation.
1. While the -h option output does include the line, "--info
Print information about all registered objects", it still wasn't immediately
clear to me that this option would list available profiles. In fact, I somehow managed to
miss the existence of --info entirely. It might be useful to actually include the list of
available profiles in the -h output. Alternatively, maybe we could move -info in the -h
output closer to the top, & specifically mention that it will list available
profiles?
2. It wasn't clear to me initially that to define a profile, you drop an
appropriately named .zip file with appropriate contents into volatility/plugins. It's
still not entirely clear, as from some of my reading it looks like you're supposed to
put the profile file into volatility/plugins/overlays/<ostype> instead. I'm
guessing both probably work, though I haven't tested. I suspect one is legacy or
something. You might want to append a notation to the -profile line in the -h output to,
"see the tools/<ostype>/README file for details on profile creation", and
then spell this out a little more clearly there, including how the profile name is
constructed, based on the name of the zip file.
3. I ran into a problem using the specific zip command listed in the
tools/linux/README file, "zip Distro.zip module.dwarf
/boot/System.map-2.6.32-8-generic". This creates a zip file with a boot subfolder
containing the System.map file, which didn't work in my testing. I had to copy the
System.map file to the current folder and then zip up the two files.
4. The linux wiki document is out of date, but I imagine you already knew that. It
should refer to the linux-trunk branch instead of the scudette branch. It also doesn't
say where to put the .zip file to create a profile, how the name of the new profile is
created, based on the .zip file name, or how to get a list of available profiles.
Thanks again
John
Show replies by date