Hi everybody,<div><br></div><div>i have tried the scudette branch r1628 for linux memory analysis and received some Errors. My test-systems were Ubuntu 11.10 (Kernel 3.0.0-17-generic, 64 Bit) and Debian 6.0.2.1 (Kernel 2.6.32-5-686, 32 Bit). The plugins i have tested were pslist, cpuinfo, dmesg, ifconfig and netstat. </div>

<div><br></div><div>As i followed the instructions at the Wiki-Page the first thing i have noticed was an NameError after the <b>vol pslist</b> command:</div><div><br></div><div><div>$ python vol.py </div><div>Welcome to volshell! </div>

<div>To get help, type &#39;help()&#39;</div><div><br></div><div>In [1]: session.filename = &quot;memory.dd&quot;</div><div>In [2]: session.profile_file = &quot;myprofile.zip&quot;</div><div>In [3]: session.profile = &quot;Linux32&quot;</div>

<div>In [4]: vol pslist</div><div>------&gt; vol(pslist)</div><div>---------------------------------------------------------------------------</div><div>NameError                                 Traceback (most recent call last)</div>

<div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div><div>----&gt; 1 </div><div>      2 </div><div>      3 </div><div>      4 </div><div>      5 </div><div><br></div><div>NameError: name &#39;pslist&#39; is not defined</div>

</div><div><br></div><div>After i changed the <b>In [4]: vol pslist</b> command into <b>In [4]: vol &quot;pslist&quot;</b> the NameError disappeared and the pslist plugin worked well on both systems.</div><div><br></div>
<div>
The next plugin was cpuinfo. On both system i&#39;ve got the right processor output, but on Ubuntu i additionally received a warning/error:</div><div><br></div><div><div>In [5]: vol &quot;cpuinfo&quot;</div><div>------&gt; vol(&quot;cpuinfo&quot;)</div>

<div>Processor    Vendor           Model                                                           </div><div><b>ERROR:root:Constant per_cpu__cpu_info does not exist in profile.</b></div><div>0            GenuineIntel     Intel(R) Core(TM)2 Duo CPU     P8600  @ 2.40GHz                 </div>

<div>Out[5]: &lt;volatility.plugins.linux.cpuinfo.CpuInfo object at 0x2fc5190&gt;</div></div><div><br></div><div>The ifconfig plugin returned on both systems a ValueError.</div><div><br></div><div><b>On Ubuntu:</b></div>
<div>
<br></div><div><div>In [6]: vol &quot;ifconfig&quot;</div><div>------&gt; vol(&quot;ifconfig&quot;)</div><div>lo       127.0.0.1        00:00:00:00:00:00               </div><div>ERROR:root:Error: Unknown format code &#39;s&#39; for object of type &#39;int&#39;</div>

<div>---------------------------------------------------------------------------</div><div>ValueError                                Traceback (most recent call last)</div><div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div>

<div>----&gt; 1 </div><div>      2 </div><div>      3 </div><div>      4 </div><div>      5 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.py in vol(self, plugin_cls, fd, debug, output, **kwargs)</div>

<div>    194             kwargs[&#39;session&#39;] = self</div><div>    195             result = plugin_cls(**kwargs)</div><div>--&gt; 196             result.render(fd)</div><div>    197 </div><div>    198             return result</div>

<div><br></div><div>/home/vitax/lin64-support/volatility/plugins/linux/ifconfig.py in render(self, outfd)</div><div>     97 </div><div>     98             outfd.write(&quot;{0:8s} {1:16s} {2:32s}\n&quot;.format(</div><div>

---&gt; 99                     <a href="http://net_dev.name" target="_blank">net_dev.name</a>, ip, mac_addr))</div><div>    100 </div><div>    101 </div><div><br></div><div>ValueError: Unknown format code &#39;s&#39; for object of type &#39;int&#39;</div>

</div><div><br></div><div><b>On Debian:</b></div><div><br></div><div><div>In [6]: vol &quot;ifconfig&quot;</div><div>------&gt; vol(&quot;ifconfig&quot;)</div><div>lo       127.0.0.1        00:00:00:00:00:00               </div>

<div>eth0     10.0.2.15        08:00:27:f6:0e:dd               </div><div>ERROR:root:Error: Unknown format code &#39;s&#39; for object of type &#39;int&#39;</div><div>---------------------------------------------------------------------------</div>

<div>ValueError                                Traceback (most recent call last)</div><div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div><div>----&gt; 1 </div><div>      2 </div><div>      3 </div>

<div>      4 </div><div>      5 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.pyc in vol(self, plugin_cls, fd, debug, output, **kwargs)</div><div>    194             kwargs[&#39;session&#39;] = self</div>

<div>    195             result = plugin_cls(**kwargs)</div><div>--&gt; 196             result.render(fd)</div><div>    197 </div><div>    198             return result</div><div><br></div><div>/home/vitax/lin64-support/volatility/plugins/linux/ifconfig.pyc in render(self, outfd)</div>

<div>     97 </div><div>     98             outfd.write(&quot;{0:8s} {1:16s} {2:32s}\n&quot;.format(</div><div>---&gt; 99                     <a href="http://net_dev.name" target="_blank">net_dev.name</a>, ip, mac_addr))</div>
<div>    100 </div>
<div>    101 </div><div><br></div><div>ValueError: Unknown format code &#39;s&#39; for object of type &#39;int&#39;</div></div><div><br></div><div>After that i tried the netstat plugin. I received on both systems an AttributeError:</div>

<div><br></div><div><b>On Ubuntu:</b></div><div><b><br></b></div><div><div>In [7]: vol &quot;netstat&quot;</div><div>------&gt; vol(&quot;netstat&quot;)</div><div>---------------------------------------------------------------------------</div>

<div>AttributeError                            Traceback (most recent call last)</div><div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div><div>----&gt; 1 </div><div>      2 </div><div>      3 </div>

<div>      4 </div><div>      5 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.py in vol(self, plugin_cls, fd, debug, output, **kwargs)</div><div>    178         &quot;&quot;&quot;</div><div>    179         if isinstance(plugin_cls, basestring):</div>

<div>--&gt; 180             plugin_cls = getattr(self.plugins, plugin_cls)</div><div>    181 </div><div>    182         if output is not None:</div><div><br></div><div>/home/vitax/lin64-support/volatility/session.py in __getattr__(self, attr)</div>

<div>     79             return self.plugins[attr]</div><div>     80         except KeyError:</div><div>---&gt; 81             raise AttributeError(attr)</div><div>     82 </div><div>     83 </div><div><br></div><div>AttributeError: netstat</div>

</div><div><br></div><div><b>On Debian:</b></div><div><b><br></b></div><div><div>In [7]: vol &quot;netstat&quot;</div><div>------&gt; vol(&quot;netstat&quot;)</div><div>ERROR: An unexpected error occurred while tokenizing input</div>

<div>The following traceback may be corrupted or invalid</div><div>The error message is: (&#39;EOF in multi-line statement&#39;, (40, 0))</div><div><br></div><div>---------------------------------------------------------------------------</div>

<div>AttributeError                            Traceback (most recent call last)</div><div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div><div>----&gt; 1 </div><div>      2 </div><div>      3 </div>

<div>      4 </div><div>      5 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.pyc in vol(self, plugin_cls, fd, debug, output, **kwargs)</div><div>    178         &quot;&quot;&quot;</div><div>    179         if isinstance(plugin_cls, basestring):</div>

<div>--&gt; 180             plugin_cls = getattr(self.plugins, plugin_cls)</div><div>    181 </div><div>    182         if output is not None:</div><div><br></div><div>/home/vitax/lin64-support/volatility/session.pyc in __getattr__(self, attr)</div>

<div>     79             return self.plugins[attr]</div><div>     80         except KeyError:</div><div>---&gt; 81             raise AttributeError(attr)</div><div>     82 </div><div>     83 </div><div><br></div><div>AttributeError: netstat</div>

</div><div><br></div><div><div>In the end i tried the dmesg plugin. On Debian it worked well, but on Ubuntu i got this error:</div><div><br></div><div><div>In [8]: vol &quot;dmesg&quot;</div><div>------&gt; vol(&quot;dmesg&quot;)</div>

<div>ERROR:root:Error: &#39;ascii&#39; codec can&#39;t decode byte 0xc2 in position 74140: ordinal not in range(128)</div><div>---------------------------------------------------------------------------</div><div>UnicodeDecodeError                        Traceback (most recent call last)</div>

<div><br></div><div>/home/vitax/lin64-support/vol.py in &lt;module&gt;()</div><div>----&gt; 1 </div><div>      2 </div><div>      3 </div><div>      4 </div><div>      5 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.py in vol(self, plugin_cls, fd, debug, output, **kwargs)</div>

<div>    194             kwargs[&#39;session&#39;] = self</div><div>    195             result = plugin_cls(**kwargs)</div><div>--&gt; 196             result.render(fd)</div><div>    197 </div><div>    198             return result</div>

<div><br></div><div>/home/vitax/lin64-support/volatility/plugins/linux/dmesg.py in render(self, outfd)</div><div>     44 </div><div>     45     def render(self, outfd):</div><div>---&gt; 46         outfd.write(self.get_dmesg())</div>

<div>     47 </div><div>     48 </div><div><br></div><div>/home/vitax/lin64-support/volatility/session.py in write(self, data)</div><div>    111     def write(self, data):</div><div>    112         # Encode the data according to the output encoding.</div>

<div><br></div><div>--&gt; 113         data = data.encode(self.encoding)</div><div>    114         try:</div><div>    115             self.pager.write(data)</div><div><br></div><div>UnicodeDecodeError: &#39;ascii&#39; codec can&#39;t decode byte 0xc2 in position 74140: ordinal not in range(128)</div>

</div></div><div><br></div>