I've never seen that error before either.Try removing all 3 of your zip files from the volatility/plugins/overlays/mac directory and replace them with the one that is attached.Then run "vol.py --info | grep Mac" again (I intentionally left off the -i because profiles will start with Mac and plugins will start with mac, and our first objective is to make sure the profile is detected).If you see a Mac 10.6.8 profile after doing this, then there's an issue with how you created your 3 profiles. If you still see an error, and no Mac 10.6.8 profile, then the problem is probably related to an environmental / host OS factor, which we can try to determine if it comes to that.MHL<10.6.8-32bit.zip>On Sun, Feb 24, 2013 at 4:38 PM, David Kovar <dkovar@gmail.com> wrote:
Greetings,
Darned '-i'.
Alas, the profiles still aren't showing up.... Interesting, and new to me, Failed message there.
-David
bash-3.2# !push
pushd volatility/plugins/overlays/mac
/usr/local/src/volatility/volatility/plugins/overlays/mac /usr/local/src/volatility
bash-3.2# pwd
/usr/local/src/volatility/volatility/plugins/overlays/mac
bash-3.2# ls -l
total 2520bash-3.2# popd
drwxr-xr-x 8 root wheel 272 Feb 24 15:19 .svn
-rw-r--r-- 1 root wheel 217337 Feb 24 15:20 10.7.5.32bit.zip
-rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.7.5.64bit.zip
-rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.8.2.64bit.zip
-rw-r--r-- 1 root wheel 0 Feb 24 15:19 __init__.py
-rw-r--r-- 1 root wheel 156 Feb 24 15:20 __init__.pyc
-rw-r--r-- 1 root wheel 34737 Feb 24 15:19 mac.py
-rw-r--r-- 1 root wheel 34533 Feb 24 15:20 mac.pyc
/usr/local/src/volatility
bash-3.2# !py
python vol.py --info | grep -i Mac
Volatile Systems Volatility Framework 2.3_alpha*** Failed to import volatility.plugins.overlays.mac.mac (TypeError: 'NoneType' object is not iterable)
MachOAddressSpace - Address space for mach-o files to support atc-ny memory readerlinux_slabinfo - Mimics /proc/slabinfo on a running machine
mac_arp - Prints the arp table
mac_check_syscalls - Checks to see if system call table entries are hooked
mac_check_sysctl - Checks for unknown sysctl handlers
mac_check_trap_table - Checks to see if system call table entries are hooked
mac_dmesg - Prints the kernel debug buffer
mac_dump_maps - Dumps memory ranges of processes
mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images
mac_get_processors - No docs
mac_ifconfig - Lists network interface information for all devices
mac_ip_filters - Reports any hooked IP filters
mac_list_sessions - Enumerates sessions
mac_list_zones - Prints active zones
mac_ls_logins - Lists login contexts
mac_lsmod - Lists loaded kernel modules
mac_lsof - Lists per-process opened files
mac_machine_info - Prints machine information about the sample
mac_mount - Prints mounted device information
mac_netstat - Lists active per-process network connections
mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext)
mac_pgrp_hash_table - Walks the process group hash table
mac_pid_hash_table - Walks the pid hash table
mac_print_boot_cmdline - Prints kernel boot arguments
mac_proc_maps - Gets memory maps of processes
mac_psaux - Prints processes with arguments in userland (**argv)
mac_pslist - List Running Processes
mac_pstree - Show parent/child relationship of processes
mac_psxview - Find hidden processes with various process listings
mac_route - Prints the routing table
mac_runq - No docs
mac_task_zone - Prints active zones
mac_tasks - List Active Tasks
mac_trustedbsd - Lists malicious trustedbsd policies
mac_version - Prints the Mac versionmac_volshell - Shell in the memory image
mac_vfs_events - Lists Mac VFS Events
-David
On Feb 24, 2013, at 3:29 PM, Jamie Levy <jamie.levy@gmail.com> wrote:
> The plugins are lower cased:
>
>
>
> On Sun, Feb 24, 2013 at 4:26 PM, David Kovar <dkovar@gmail.com> wrote:
>> Greetings,
>>
>> Thank you for your help, particularly on a Sunday!
>>
>> I'm still running into issues with this for some reason. I checked out a new
>> copy, copied my profiles in, and then:
>>
>> Sun Feb 24 15:21:49 CST 2013
>> bash-3.2# python vol.py --info | grep Mac
>> Volatile Systems Volatility Framework 2.3_alpha
>> MachOAddressSpace - Address space for mach-o files to support atc-ny
>> memory reader
>> mac_version - Prints the Mac version
>> mac_vfs_events - Lists Mac VFS Events
>> bash-3.2# ls -l volatility/plugins/overlays/mac
>> total 2520
>> drwxr-xr-x 8 root wheel 272 Feb 24 15:19 .svn
>> -rw-r--r-- 1 root wheel 217337 Feb 24 15:20 10.7.5.32bit.zip
>> -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.7.5.64bit.zip
>> -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.8.2.64bit.zip
>> -rw-r--r-- 1 root wheel 0 Feb 24 15:19 __init__.py
>> -rw-r--r-- 1 root wheel 156 Feb 24 15:20 __init__.pyc
>> -rw-r--r-- 1 root wheel 34737 Feb 24 15:19 mac.py
>> -rw-r--r-- 1 root wheel 34533 Feb 24 15:20 mac.pyc
>>
>> -David
>>
>> On Feb 24, 2013, at 3:10 PM, Michael Hale Ligh <michael.hale@gmail.com>
>> wrote:
>>
>> David,
>>
>> It is not intentional for volatility.plugins.overlays.mac to be missing from
>> setup.py (it was probably missed when merging the old mac branch into
>> trunk). However, unless you plan on using volatility as a library (i.e.
>> importing it from other Python scripts), you don't need setup.py at all.
>>
>> $ svn checkout https://volatility.googlecode.com/svn/trunk/ volatility
>> $ cd volatility
>> $ cp <PATH TO YOUR PROFILE>/Mac10.6.zip volatility/plugins/overlays/mac
>> $ python vol.py --info | grep Mac
>>
>> Before the 2.3 release, setup.py will be fixed in case you do plan on
>> installing volatility as a library. Also, pre-built Mac profiles for all
>> common OS X kernels will be available at that time, so you won't need to
>> build your own.
>>
>> MHL
>>
>>
>>
>> On Sun, Feb 24, 2013 at 2:42 PM, David Kovar <dkovar@gmail.com> wrote:
>>>
>>> Greetings,
>>>
>>> I was adding OS X support to my copy of Volatility per the instructions on
>>> https://code.google.com/p/volatility/wiki/MacMemoryForensics. It went well
>>> but I thought I'd pull the most recent version while I was at it.
>>>
>>> Mac support went away when I did so. setup.py is now missing:
>>>
>>> "volatility.plugins.overlays.mac",
>>>
>>> Even when I add that back, vol.py --info doesn't show the OS X profiles.
>>>
>>> Is this intentional? Is there a different version that I should be using?
>>>
>>> Thanks!
>>>
>>> -David
>>>
>>>
>>> _______________________________________________
>>> Vol-users mailing list
>>> Vol-users@volatilesystems.com
>>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>>>
>>
>>
>>
>> _______________________________________________
>> Vol-users mailing list
>> Vol-users@volatilesystems.com
>> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>>
>
>
>
> --
> PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92