Hi,<div><br></div><div>I&#39;m trying to analyze linux memory dumps with scudettesbranch r2040, but it doesn&#39;t seems to work. </div><div><br></div><div>Is there something I do wrong?</div><div><br></div><div><br></div>
<div><b><u>Ubuntu 11.04 64bit (acquired with lime, padded format)</u></b></div><div><br></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div><div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div>
<div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div><div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div><div>?         -&gt; Introduction and overview of IPython&#39;s features.</div>
<div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div><div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div><div><br></div><div>Welcome to the volatility interactive shell!</div>
<div>To get help, type &#39;vhelp()&#39;</div><div>In [1]: session.filename = &quot;N:\Lime\Ubuntu-11.04-64-bit\u64.padded&quot;</div><div>In [2]: session.profile_file = &quot;N:\Lime\Ubuntu-11.04-64-bit\myprofile.zip&quot;</div>
<div>In [3]: session.profile = profiles.Linux64</div><div>In [4]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>WARNING:root:comm has no offset in object task_struct. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:name has no offset in object net_device. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:s_id has no offset in object super_block. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:sun_path has no offset in object sockaddr_un. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:x86_model_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:x86_vendor_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:name has no offset in object module. Check that vtypes has a concrete definition for it.</div>
<div>Offset   Name                 Pid             Uid</div><div>ERROR:root:Error: Type task_struct has no member tasks</div><div>---------------------------------------------------------------------------</div><div>AttributeError                            Traceback (most recent call last)</div>
<div>&lt;ipython-input-4-a5edbfb3c155&gt; in &lt;module&gt;()</div><div>----&gt; 1 vol(plugins.pslist)</div><div><br></div><div>H:\Volatility\Scudette\volatility\session.pyc in vol(self, plugin_cls, *args, **kwargs)</div>
<div>    217             result = plugin_cls(*args, **kwargs)</div><div>    218             try:</div><div>--&gt; 219                 result.render(ui_renderer)</div><div>    220             except KeyboardInterrupt:</div>
<div>    221                 self.report_progress(&quot;Aborted!\r\n&quot;, force=True)</div><div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in render(self, outfd)</div><div>     49             &quot;Offset&quot;, &quot;Name&quot;, &quot;Pid&quot;, &quot;Uid&quot;))</div>
<div>     50</div><div>---&gt; 51         for task in self.pslist():</div><div>     52             outfd.write(&quot;0x{0:08x} {1:20s} {2:15s} {3:15s}\n&quot;.format(</div><div>     53                 task.obj_offset, task.comm, str(task.pid), str(task.uid)))</div>
<div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in pslist(self)</div><div>     42</div><div>     43         # walk the -&gt;tasks list, note that this will *not* display &quot;swapper&quot;</div>
<div>---&gt; 44         for task in init_task.tasks:</div><div>     45             yield task</div><div>     46</div><div><br></div><div>H:\Volatility\Scudette\volatility\obj.pyc in __getattr__(self, attr)</div><div>    921         if attr not in self.members:</div>
<div>    922             raise AttributeError(&quot;Type {0} has no member {1}&quot;.format(</div><div>--&gt; 923                     self.obj_name, attr))</div><div>    924</div><div>    925         return self.m(attr)</div>
<div><br></div><div>AttributeError: Type task_struct has no member tasks</div><div><br></div><div><br></div><div><b><u>Ubuntu 11.04 64bit (acquired with lime, raw format)</u></b>
</div><div><b><u><br></u></b></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div><div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div><div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div>
<div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div><div>?         -&gt; Introduction and overview of IPython&#39;s features.</div><div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div>
<div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div><div><br></div><div>Welcome to the volatility interactive shell!</div><div>To get help, type &#39;vhelp()&#39;</div><div>
In [1]: session.filename = &quot;N:\\Lime\\Ubuntu-11.04-64-bit\\u64.raw&quot;</div><div>In [2]: session.profile_file = &quot;N:\\Lime\\Ubuntu-11.04-64-bit\\myprofile.zip&quot;</div><div>In [3]: session.profile = profiles.Linux64</div>
<div>In [4]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>WARNING:root:comm has no offset in object task_struct. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:name has no offset in object net_device. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:s_id has no offset in object super_block. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:sun_path has no offset in object sockaddr_un. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:x86_model_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it.</div><div>WARNING:root:x86_vendor_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it.</div>
<div>WARNING:root:name has no offset in object module. Check that vtypes has a concrete definition for it.</div><div>Offset   Name                 Pid             Uid</div><div>Out[4]: &lt;volatility.plugins.linux.pslist.LinuxPsList at 0x2e50930&gt;</div>
</div><div><br></div><div><br></div><div><br></div><div><b><u>Fedora 15 32bit (acquired with lime, raw format)</u></b>
</div></div><div><br></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div><div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div><div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div>
<div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div><div>?         -&gt; Introduction and overview of IPython&#39;s features.</div><div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div>
<div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div><div><br></div><div>Welcome to the volatility interactive shell!</div><div>To get help, type &#39;vhelp()&#39;</div><div>
In [1]: session.filename = &quot;N:\\Lime\\Fedora-15-32bit\\f32.raw&quot;</div><div>In [2]: session.profile_file = &quot;N:\\Lime\\Fedora-15-32bit\\myprofile.zip&quot;</div><div>In [3]: session.profile = profiles.Linux32</div>
<div>In [4]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>ERROR:root:Fatal Error: invalid literal for int() with base 10: &#39;Attribute&#39;</div><div>ERROR:root:Failed running plugin pslist: kernel_address_space not specified.</div>
<div><br></div><div>In [5]: session.kernel_address_space = &quot;standard&quot;</div><div>In [6]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>Offset   Name                 Pid             Uid</div>
<div>ERROR:root:Error: &#39;init_task&#39;</div><div>---------------------------------------------------------------------------</div><div>KeyError                                  Traceback (most recent call last)</div><div>
&lt;ipython-input-6-a5edbfb3c155&gt; in &lt;module&gt;()</div><div>----&gt; 1 vol(plugins.pslist)</div><div><br></div><div>H:\Volatility\Scudette\volatility\session.pyc in vol(self, plugin_cls, *args, **kwargs)</div><div>
    217             result = plugin_cls(*args, **kwargs)</div><div>    218             try:</div><div>--&gt; 219                 result.render(ui_renderer)</div><div>    220             except KeyboardInterrupt:</div><div>
    221                 self.report_progress(&quot;Aborted!\r\n&quot;, force=True)</div><div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in render(self, outfd)</div><div>     49             &quot;Offset&quot;, &quot;Name&quot;, &quot;Pid&quot;, &quot;Uid&quot;))</div>
<div>     50</div><div>---&gt; 51         for task in self.pslist():</div><div>     52             outfd.write(&quot;0x{0:08x} {1:20s} {2:15s} {3:15s}\n&quot;.format(</div><div>     53                 task.obj_offset, task.comm, str(task.pid), str(task.uid)))</div>
<div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in pslist(self)</div><div>     35     def pslist(self):</div><div>     36         &quot;&quot;&quot;A generator of task_struct objects for all running tasks.&quot;&quot;&quot;</div>
<div>---&gt; 37         init_task_addr = self.profile.constants[&quot;init_task&quot;]</div><div>     38</div><div>     39         init_task = self.profile.Object(theType=&quot;task_struct&quot;,</div><div><br></div><div>
KeyError: &#39;init_task&#39;</div></div><div><br></div><div><br></div><div><b><u>Fedora 15 32bit (virtual box snapshot)</u></b>
</div><div><b><br></b></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div><div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div><div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div>
<div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div><div>?         -&gt; Introduction and overview of IPython&#39;s features.</div><div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div>
<div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div><div><br></div><div>Welcome to the volatility interactive shell!</div><div>To get help, type &#39;vhelp()&#39;</div><div>
In [1]: session.filename = &quot;V:\\VM\\Fedora Core 15 32-bit\\Snapshots\\2012-07-17T14-50-40-994836400Z.sav&quot;</div><div>In [2]: session.profile_file = &quot;N:\\Lime\\Fedora-15-32bit\\myprofile.zip&quot;</div><div>In [3]: session.profile = profiles.Linux32</div>
<div>In [4]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>ERROR:root:Fatal Error: invalid literal for int() with base 10: &#39;Attribute&#39;</div><div>ERROR:root:Failed running plugin pslist: kernel_address_space not specified.</div>
<div><br></div><div>In [5]: session.kernel_address_space = &quot;vboxelf&quot;</div><div>In [6]: vol plugins.pslist</div><div>------&gt; vol(plugins.pslist)</div><div>Offset   Name                 Pid             Uid</div>
<div>ERROR:root:Error: &#39;init_task&#39;</div><div>---------------------------------------------------------------------------</div><div>KeyError                                  Traceback (most recent call last)</div><div>
&lt;ipython-input-7-a5edbfb3c155&gt; in &lt;module&gt;()</div><div>----&gt; 1 vol(plugins.pslist)</div><div><br></div><div>H:\Volatility\Scudette\volatility\session.pyc in vol(self, plugin_cls, *args, **kwargs)</div><div>
    217             result = plugin_cls(*args, **kwargs)</div><div>    218             try:</div><div>--&gt; 219                 result.render(ui_renderer)</div><div>    220             except KeyboardInterrupt:</div><div>
    221                 self.report_progress(&quot;Aborted!\r\n&quot;, force=True)</div><div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in render(self, outfd)</div><div>     49             &quot;Offset&quot;, &quot;Name&quot;, &quot;Pid&quot;, &quot;Uid&quot;))</div>
<div>     50</div><div>---&gt; 51         for task in self.pslist():</div><div>     52             outfd.write(&quot;0x{0:08x} {1:20s} {2:15s} {3:15s}\n&quot;.format(</div><div>     53                 task.obj_offset, task.comm, str(task.pid), str(task.uid)))</div>
<div><br></div><div>H:\Volatility\Scudette\volatility\plugins\linux\pslist.pyc in pslist(self)</div><div>     35     def pslist(self):</div><div>     36         &quot;&quot;&quot;A generator of task_struct objects for all running tasks.&quot;&quot;&quot;</div>
<div>---&gt; 37         init_task_addr = self.profile.constants[&quot;init_task&quot;]</div><div>     38</div><div>     39         init_task = self.profile.Object(theType=&quot;task_struct&quot;,</div><div><br></div><div>
KeyError: &#39;init_task&#39;</div><div><br></div><div><br></div><div><b><u>The analysis works with Windows XP SP3</u></b></div><div><br></div><div><div>H:\Volatility\Scudette&gt;h:\Python27\python.exe vol.py</div><div>Python 2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]</div>
<div>Type &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.</div><div><br></div><div>IPython 0.13 -- An enhanced Interactive Python.</div><div>?         -&gt; Introduction and overview of IPython&#39;s features.</div>
<div>%quickref -&gt; Quick reference.</div><div>help      -&gt; Python&#39;s own help system.</div><div>object?   -&gt; Details about &#39;object&#39;, use &#39;object??&#39; for extra details.</div><div><br></div><div>Welcome to the volatility interactive shell!</div>
<div>To get help, type &#39;vhelp()&#39;</div><div>In [1]: session.filename = &quot;W:\XP SP3\XP SP3-Snapshot7.vmem&quot;</div><div>In [2]: session.profile = profiles.WinXPSP3x86</div><div>In [3]: vol plugins.pslist</div>
<div>------&gt; vol(plugins.pslist)</div><div>Offset (V) Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                Exit</div><div>---------- -------------------- ------ ------ ------ -------- ------ ------ -------------------- --------------------</div>
<div>0x867c49c8 System                    4      0     54      216 ------  False -                    -</div><div>0x8656b020 smss.exe                556      4      3       17 ------  False 2008-11-19 19:30:19  -</div><div>
[...]</div><div>Out[3]: &lt;volatility.plugins.windows.taskmods.WinPsList at 0x21668f0&gt;</div></div><div><br></div><div><br></div><div>Thanks in advance for your help!</div><div><br></div><div>Sebastien</div><div><br></div>
</div><div><br></div>