Re: [Vol-users] Volatility-Linux TypeError

Patrick, The backtrace you got was because the init_task was not found or had an invalid address. Can you please check that there is such a symbol on your System.map. For example: ~/projects/volatility(scudette_playground)$ unzip -p system.zip boot/System.map-3.0.0-12-server | grep init_task ffffffff810de840 T ftrace_graph_init_task ffffffff811065c0 T perf_event_init_task ffffffff81a69cb0 r __ksymtab_init_task ffffffff81a7e998 r __kcrctab_init_task ffffffff81a87790 r __kstrtab_init_task ffffffff81c0b020 D init_task ffffffff81eed8a0 b ext4_lazyinit_task This address (e.g. ffffffff81c0b020) needs to be valid in the kernel AS. If it appears valid, then maybe we can not parse the kernel AS properly. I dont think task_structs can be paged in linux so there is something really wrong if its not there. Michael. On 28 January 2012 05:16, Patrick Burkard <pbuml(a)gmx.de> wrote: