So close but so far. No clue how they collected the image but that might be the problem.
Praha:Memory Image kovar$ python /usr/local/src/volatility/vol.py --profile=Mac10_7_5_64bitx64 -f *.img mac_psaux
Volatile Systems Volatility Framework 2.3_alpha
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareSnapshotFile: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
JKIA32PagedMemoryPae: No base Address Space
AMD64PagedMemory: No base Address Space
JKIA32PagedMemory: No base Address Space
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF64 Header signature invalid
VMWareSnapshotFile: Invalid VMware signature: 0x7ea6766
WindowsCrashDumpSpace32: Header signature invalid
JKIA32PagedMemoryPae: Incompatible profile Mac10_7_5_64bitx64 selected
AMD64PagedMemory: Failed valid Address Space check
JKIA32PagedMemory: Incompatible profile Mac10_7_5_64bitx64 selected
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Incompatible profile Mac10_7_5_64bitx64 selected
And without a profile, which I didn't expect to work:
Praha:Memory Image kovar$ python /usr/local/src/volatility/vol.py -f *.img imageinfo
Volatile Systems Volatility Framework 2.3_alpha
Determining profile based on KDBG search...
Suggested Profile(s) : No suggestion (Instantiated with Mac10_6_8-32bitx86)
AS Layer1 : ArmAddressSpace (Kernel AS)
AS Layer2 : FileAddressSpace (/Volumes/<path stuff>/foo.img)
PAE type : No PAE
DTB : 0x101000
Traceback (most recent call last):
File "/usr/local/src/volatility/vol.py", line 186, in <module>
main()
File "/usr/local/src/volatility/vol.py", line 177, in main
command.execute()
File "/usr/local/src/volatility/volatility/commands.py", line 111, in execute
func(outfd, data)
File "/usr/local/src/volatility/volatility/plugins/imageinfo.py", line 34, in render_text
for k, v in data:
File "/usr/local/src/volatility/volatility/plugins/imageinfo.py", line 91, in calculate
kdbgoffset = volmagic.KDBG.v()
File "/usr/local/src/volatility/volatility/obj.py", line 735, in __getattr__
return self.m(attr)
File "/usr/local/src/volatility/volatility/obj.py", line 717, in m
raise AttributeError("Struct {0} has no member {1}".format(self.obj_name, attr))
AttributeError: Struct VOLATILITY_MAGIC has no member KDBG
-David
Greetings,
I rebuilt the 10.7.5 profiles. The 32 bit one causes that odd error. The 64 bit one works.
I'm doing this all on a 10.8.x (64 bit) system. Perhaps that is the problem?
-David
bash-3.2# !py
python vol.py --info | grep -i mac
Volatile Systems Volatility Framework 2.3_alpha
MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader
Mac10_6_8-32bitx86 - A Profile for Mac 10.6.8-32bit x86
Mac10_7_5_64bitx64 - A Profile for Mac 10.7.5.64bit x64
linux_slabinfo - Mimics /proc/slabinfo on a running machine
mac_arp - Prints the arp table
mac_check_syscalls - Checks to see if system call table ent
Greetings,
That worked:
bash-3.2# python vol.py --info | grep -i Mac
Volatile Systems Volatility Framework 2.3_alpha
MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader
Mac10_6_8-32bitx86 - A Profile for Mac 10.6.8-32bit x86
linux_slabinfo - Mimics /proc/slabinfo on a running machine
And when I left the old zip files in place, the odd error was present.
My first zip file did work with whatever version of volatility I had before I did the update. Recreating it probably doesn't make sense. I'll go build a new set.
Thanks very much for the help!
-David
I've never seen that error before either.
Try removing all 3 of your zip files from the volatility/plugins/overlays/mac directory and replace them with the one that is attached.
Then run "vol.py --info | grep Mac" again (I intentionally left off the -i because profiles will start with Mac and plugins will start with mac, and our first objective is to make sure the profile is detected).
If you see a Mac 10.6.8 profile after doing this, then there's an issue with how you created your 3 profiles. If you still see an error, and no Mac 10.6.8 profile, then the problem is probably related to an environmental / host OS factor, which we can try to determine if it comes to that.
MHL