Could you send us the profile you created? Also, could you re-run linux_pslist but add -dd before it and send us that output?<br><br>If the memory capture is something you are willing to share with the Vol devs then we can really debug the issue with the profile and help you get it sorted. We have a FTP server we could give you access to in order to upload it.<br>
<br><div class="gmail_quote">On Sun, Mar 10, 2013 at 7:00 PM, Pasquale Stirparo <span dir="ltr">&lt;<a href="mailto:pstirparo@gmail.com" target="_blank">pstirparo@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi,<div><br></div><div>I was wondering: did anyone ever managed to do an analysis with a real device? I know the answer is Yes. </div><div>The thing is that I&#39;ve seen around many nice examples and tutorials working... but all of them with the emulator. The only real device sample &quot;in the wild&quot; seems to be the Evo4GRodeo samples from DFWRS Challenge.</div>

<div><br></div><div>This time I&#39;m pretty sure I did (almost?) everything right. Although if it doesn&#39;t work, probably it&#39;s not.</div><div>I&#39;ve tried also with another smartphone other than the HTC One X, the Galaxy Nexus, getting the correct kernel version. No compilation errors, no module errors, no lime module crashing on the phone, no volatility profiles error, nothing. Everything (looks) right.</div>

<div><br></div><div>But still, when trying to run volatility I still keep getting empty results like this:</div><div><div><br></div><div>hydra:volatility-read-only paco$ python vol.py --profile=LinuxGalaxyNexus-3_0_1x86 -f ~/memdump/test-lime-4.7.lime linux_pslist</div>

<div>Volatile Systems Volatility Framework 2.3_alpha</div><div>WARNING : volatility.obj      : Overlay structure cpuinfo_x86 not present in vtypes</div><div>Offset     Name                 Pid             Uid             Gid    DTB        Start Time</div>

<div>---------- -------------------- --------------- --------------- ------ ---------- ----------</div><div><br></div><div><br></div><div>Now I start wondering two things:</div><div>- Is it my lime dump the issue? the header looks fine, if I look inside with hexdump it seems reasonable, if I strings it I find my data.</div>

<div>- Is it the volatility profile? Maybe, because I&#39;ve event tried to dump the memory of my Galaxy Nexus with FROST (which uses LiME) and the result looks the same. So I started believing my problem is in the profile, although I cannot seem to find any other way to understand where the problem could be.</div>

<div><br></div><div>So if anyone who successfully analyzed Android memory dumps from any real life device is willing to share his experience and/or Volatility profile, it would be great.</div><div><br></div>
<div>Thanks</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>P.</div><div><br></div><div><br></div><div><br></div><div><div><br></div>-- <br>Pasquale Stirparo, MEng    <br>GCFA, OPST, OWSE, ECCE                      <br>

<br></div></font></span></div></div>
</blockquote></div><br>