Hi Michael,<div><br></div><div>You were right, the problem was related to the profile file (for Ubuntu, not Fedora). I was using module.ko to generate module.dwarf (with the command line dwarfdump
-di module.ko &gt; module.dwarf). It seems that dwarfdump needs to be run only on module_dwarf.ko.</div><div><br></div><div>Everything works as expected in Ubuntu (with the padded memory dump only). However, there still a bug with Fedora</div>
<div><br></div><div>Here&#39;s the commands I used to create the profile file:</div><br>1- apt-get install dwarfdump   (Ubuntu)     or   yum install libdwarf-tools (Fedora)<br>2- svn checkout <a href="http://volatility.googlecode.com/svn/branches/scudette/tools/linux">http://volatility.googlecode.com/svn/branches/scudette/tools/linux</a> linuxProfile<br>
3- cd linuxProfile<br>4- make<div>5- dwarfdump -di 
module_dwarf.ko &gt; module.dwarf <br>6- sudo zip myprofile.zip 
module.dwarf   /boot/System.map-[…]-generic</div><div><br></div><div>When I run dwarfdump in Fedora 15 32-bit, I have a lots of errors like:</div><div><br></div><div>dwarfdump:  ERROR: Attribute 56 (DW_AT_data_member_location)  has form 5 (DW_FORM_data2), a form which is not appropriate</div>
<div><br><div>module.dwarf contains data, but when I run volatility with this debug information, I have an error and I need to specify an address space:</div><div><br></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div>
<div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div><div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div><div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div>
<div>?         -&gt; Introduction and overview of IPython&#39;s features.</div><div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div><div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div>
<div><br></div><div>Welcome to the volatility interactive shell!</div><div>To get help, type &#39;vhelp()&#39;</div><div>In [1]: session.filename = &quot;N:\\Lime\\Fedora-15-32bit\\f32.padded&quot;</div><div>In [2]: session.profile_file = &quot;N:\\Lime\\Fedora-15-32bit\\myprofile.zip&quot;</div>
<div>In [3]: session.profile = profiles.Linux64</div><div>In [4]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>ERROR:root:Fatal Error: invalid literal for int() with base 10: &#39;Attribute&#39;</div>
<div>ERROR:root:Failed running plugin pslist: kernel_address_space not specified.</div><div><br></div><div>In [5]: session.kernel_address_space = &quot;standard&quot;</div><div>In [6]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div>
<div>Offset   Name                 Pid             Uid</div><div>ERROR:root:Error: &#39;init_task&#39;</div><div>---------------------------------------------------------------------------</div><div>KeyError                                  Traceback (most recent call last)</div>
<div>&lt;ipython-input-6-a5edbfb3c155&gt; in &lt;module&gt;()</div><div>----&gt; 1 vol(plugins.pslist)</div><div><br></div><div>H:\Volatility\Scudette\volatility\session.pyc in vol(self, plugin_cls, *args, **kwargs)</div>
<div>    217             result = plugin_cls(*args, **kwargs)</div><div>    218             try:</div><div>--&gt; 219                 result.render(ui_renderer)</div><div>    220             except KeyboardInterrupt:</div>
<div>    221                 self.report_progress(&quot;Aborted!\r\n&quot;, force=True)</div><div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in render(self, outfd)</div><div>     49             &quot;Offset&quot;, &quot;Name&quot;, &quot;Pid&quot;, &quot;Uid&quot;))</div>
<div>     50</div><div>---&gt; 51         for task in self.pslist():</div><div>     52             outfd.write(&quot;0x{0:08x} {1:20s} {2:15s} {3:15s}\n&quot;.format(</div><div>     53                 task.obj_offset, task.comm, str(task.pid), str(task.uid)))</div>
<div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in pslist(self)</div><div>     35     def pslist(self):</div><div>     36         &quot;&quot;&quot;A generator of task_struct objects for all running tasks.&quot;&quot;&quot;</div>
<div>---&gt; 37         init_task_addr = self.profile.constants[&quot;init_task&quot;]</div><div>     38</div><div>     39         init_task = self.profile.Object(theType=&quot;task_struct&quot;,</div><div><br></div><div>
KeyError: &#39;init_task&#39;</div></div><div><br></div><div>Thanks for your help!</div><div><br></div><div>Sebastien </div><div><div>  </div></div></div>