Re: [Vol-users] Mac support vanished in latest alpha?

I've never seen that error before either. Try removing all 3 of your zip files from the volatility/plugins/overlays/mac directory and replace them with the one that is attached. Then run "vol.py --info | grep Mac" again (I intentionally left off the -i because profiles will start with Mac and plugins will start with mac, and our first objective is to make sure the profile is detected). If you see a Mac 10.6.8 profile after doing this, then there's an issue with how you created your 3 profiles. If you still see an error, and no Mac 10.6.8 profile, then the problem is probably related to an environmental / host OS factor, which we can try to determine if it comes to that. MHL On Sun, Feb 24, 2013 at 4:38 PM, David Kovar &lt;dkovar(a)gmail.com&gt; wrote: Greetings, Darned '-i'. Alas, the profiles still aren't showing up.... Interesting, and new to me, Failed message there. -David bash-3.2# !push pushd volatility/plugins/overlays/mac /usr/local/src/volatility/volatility/plugins/overlays/mac /usr/local/src/volatility bash-3.2# pwd /usr/local/src/volatility/volatility/plugins/overlays/mac bash-3.2# ls -l total 2520 drwxr-xr-x 8 root wheel 272 Feb 24 15:19 .svn -rw-r--r-- 1 root wheel 217337 Feb 24 15:20 10.7.5.32bit.zip -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.7.5.64bit.zip -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.8.2.64bit.zip -rw-r--r-- 1 root wheel 0 Feb 24 15:19 __init__.py -rw-r--r-- 1 root wheel 156 Feb 24 15:20 __init__.pyc -rw-r--r-- 1 root wheel 34737 Feb 24 15:19 mac.py -rw-r--r-- 1 root wheel 34533 Feb 24 15:20 mac.pyc bash-3.2# popd /usr/local/src/volatility bash-3.2# !py python vol.py --info | grep -i Mac Volatile Systems Volatility Framework 2.3_alpha *** Failed to import volatility.plugins.overlays.mac.mac (TypeError: 'NoneType' object is not iterable) MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader linux_slabinfo - Mimics /proc/slabinfo on a running machine mac_arp - Prints the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_get_processors - No docs mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in userland (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_runq - No docs mac_task_zone - Prints active zones mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image -David On Feb 24, 2013, at 3:29 PM, Jamie Levy &lt;jamie.levy(a)gmail.com&gt; wrote: <10.6.8-32bit.zip>