I&#39;ve tried this on SuSE Linux 11.1 32-bit and 64-bit with the same results.  <div><br></div><div>Following linux instructions for creating a profile, dwarfdump is unable to locate module.ko.</div><div><a href="https://code.google.com/p/volatility/wiki/LinuxMemoryForensics">https://code.google.com/p/volatility/wiki/LinuxMemoryForensics</a></div>
<div><div><div><br></div><div><br></div><div><div>

user@linux:~&gt; cat /etc/SuSE-release</div><div>SUSE Linux Enterprise Server 11 (i586)</div><div>VERSION = 11</div><div>PATCHLEVEL = 1</div><div><br></div><div>user@linux:~&gt; uname -r</div><div>2.6.32.12-0.7-pae</div>
</div><div><br></div><div><div>user@linux:~&gt; wget <a href="https://volatility.googlecode.com/files/volatility-2.2.tar.gz" target="_blank">https://volatility.googlecode.com/files/volatility-2.2.tar.gz</a></div><div><br>
</div>
<div>user@linux:~&gt; tar -xzf volatility-2.2.tar.gz</div>
</div><div><br></div><div>user@linux:~&gt; cd volatility-2.2/tools/linux</div><div><br></div><div><div>user@linux:~/volatility-2.2/tools/linux&gt; sudo make</div><div>.... wait a very long time on first run ....</div><div>
<div>WARNING: modpost: Found 6 section mismatch(es).</div><div>To see full details build your kernel with:</div><div>&#39;make CONFIG_DEBUG_SECTION_MISMATCH=y&#39;</div></div><div>

make[1]: Leaving directory `/usr/src/linux-2.6.32.12-0.7-obj/i386/pae&#39;</div><div>dwarfdump -di module.ko &gt; module.dwarf</div><div>dwarfdump ERROR:  can&#39;t open module.ko</div><div>make: *** [dwarf] Error 1</div>
<div><br></div><div><div>user@linux:~/volatility-2.2/tools/linux&gt; sudo make CONFIG_DEBUG_SECTION_MISMATCH=y</div></div><div>....</div><div><div>make[1]: Leaving directory `/usr/src/linux-2.6.32.12-0.7-obj/i386/pae&#39;</div>
<div>dwarfdump -di module.ko &gt; module.dwarf</div><div>dwarfdump ERROR:  can&#39;t open module.ko</div><div>make: *** [dwarf] Error 1</div></div><div><br></div><div><div>user@linux:~/volatility-2.2/tools/linux&gt; dwarfdump -V</div>
<div> Tue Apr 10 11:43:32 PDT 2012</div></div><div><br></div><div>What am I missing?</div>

</div></div></div>