Re: [Vol-users] Re: Bug or documentation error - linux_dump_map

Hi Edwin, You're right, it looks like there were a few different issues with that plugin. I applied a patch [1] similar to yours that should make things easier. It now accepts -p, but also takes a --dump-dir argument instead of --outfile. You can dump all VMAs from all processes, all VMAs from a specific process (or multiple processes with -p 1,2,3) or a specific VMA from a specific process. The output file name includes the task ID as well as the VMA starting address. There's a summary printed to stdout to minimize confusion. For example: Task VM Start VM End Length Path ---------- ---------- ---------- ---------- ---- 1 0x08048000 0x0811d000 0xd5000 dumps/task.1.0x8048000.vma 1 0x0811e000 0x08124000 0x6000 dumps/task.1.0x811e000.vma 1 0x08124000 0x08125000 0x1000 dumps/task.1.0x8124000.vma 1 0x08125000 0x081b0000 0x8b000 dumps/task.1.0x8125000.vma 1 0xb7522000 0xb752e000 0xc000 dumps/task.1.0xb7522000.vma Can you try the patch and let me know if it works for you? Thanks, MHL [1]. https://code.google.com/p/volatility/source/detail?r=3169 On Thu, Mar 7, 2013 at 7:06 AM, Edwin Smulders <edwin.smulders(a)gmail.com> wrote: