Hello, Thank you for the information about the newer versions in the scudete and lin64-support branches. I tried those two, but unfortunately without success. But step by step: I created a new profile for the analysis target with the steps mentioned in the readme. This seems to work with a warning at the end of the process that you can see at [1]. When I try to use this profile with the scudete version i still get the known TypeError with some more warnings and information [2]. The lin64 Version produces another Error Message I posted at [3]. I use volatility on a Debian Squeeze 64-Bit version: $ uname -a Linux Ragana 2.6.32-5-amd64 #1 SMP Mon Jan 16 16:22:28 UTC 2012 x86_64 GNU/Linux Hopefully this information is helpful for you and we can find the reason for my problems. Please ask if you need more information. Greetings Patrick [1] /mnt/host/tools/linux/pmem.c: In function ‘pmem_read_partial’: /mnt/host/tools/linux/pmem.c:142: warning: comparison of distinct pointer types lacks a cast Building modules, stage 2. MODPOST 2 modules make[4]: Warning: File `/mnt/host/tools/linux/module.mod.c' has modification time 0,095 s in the future CC /mnt/host/tools/linux/module.mod.o LD [M] /mnt/host/tools/linux/module.ko CC /mnt/host/tools/linux/pmem.mod.o LD [M] /mnt/host/tools/linux/pmem.ko make[4]: Warnung: Mit der Uhr stimmt etwas nicht. Die Bearbeitung könnte unvollständig sein. [2] Volatile Systems Volatility Framework 2.1_alpha WARNING : volatility.obj : comm has no offset in object task_struct. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object net_device. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : s_id has no offset in object super_block. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : sun_path has no offset in object sockaddr_un. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_model_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_vendor_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object module. Check that vtypes has a concrete definition for it. INFO : volatility.plugins.overlays.linux.linux32: Found dwarf file module.dwarf INFO : volatility.plugins.overlays.linux.linux32: Found dwarf file boot/System.map-2.6.32-5-686 Loaded profile Linux32 Offset Name Pid Uid Traceback (most recent call last): File "./vol.py", line 202, in <module> main() File "./vol.py", line 192, in main command_obj.execute() File "/home/dark-eye/Sources/volatility_scudette/volatility/commands.py", line 166, in execute func(outfd, data) File "/home/dark-eye/Sources/volatility_scudette/volatility/plugins/linux/linux_task_list_ps.py", line 61, in render_text for task in data: File "/home/dark-eye/Sources/volatility_scudette/volatility/plugins/linux/linux_task_list_ps.py", line 51, in calculate for task in linux_common.walk_list_head("task_struct", "tasks", init_task.tasks, self.addr_space): File "/home/dark-eye/Sources/volatility_scudette/volatility/plugins/linux/linux_common.py", line 121, in walk_list_head yield obj.Object(struct_name, offset = list_ptr - offset, vm = addr_space) TypeError: unsupported operand type(s) for -: 'instancemethod' and 'int' [3] Volatile Systems Volatility Framework 2.1_alpha WARNING : volatility.obj : comm has no offset in object task_struct. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object net_device. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : s_id has no offset in object super_block. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : sun_path has no offset in object sockaddr_un. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_model_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_vendor_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object module. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : comm has no offset in object task_struct. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object net_device. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : s_id has no offset in object super_block. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : sun_path has no offset in object sockaddr_un. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_model_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : x86_vendor_id has no offset in object cpuinfo_x86. Check that vtypes has a concrete definition for it. WARNING : volatility.obj : name has no offset in object module. Check that vtypes has a concrete definition for it. Offset Name Pid Uid Traceback (most recent call last): File "./vol.py", line 171, in <module> main() File "./vol.py", line 161, in main command.execute() File "/home/dark-eye/Sources/volatility_linux64/volatility/commands.py", line 135, in execute func(outfd, data) File "/home/dark-eye/Sources/volatility_linux64/volatility/plugins/linux/linux_task_list_ps.py", line 62, in render_text for task in data: File "/home/dark-eye/Sources/volatility_linux64/volatility/plugins/linux/linux_task_list_ps.py", line 41, in calculate init_task_addr = self.smap["init_task"] TypeError: 'NoneType' object is unsubscriptable

Am Sat, 28 Jan 2012 00:39:45 +0100 schrieb Michael Cohen &lt;scudette(a)gmail.com&gt;: Alright ... here we go. This is the content of the profile zip: dark-eye@Ragana:~/Sources/volatility_linux64$ zipinfo -l -rw-r--r-- 3.0 unx 1293706 tx 338478 defN 12-Jan-11 18:24 boot/System.map-2.6.32-5-686 -rw-r--r-- 3.0 unx 1364923 tx 130532 defN 12-Jan-27 22:35 module.dwarf 3 files, 3952335 bytes uncompressed, 778032 bytes compressed: 80.3% The image is captured from a VirtualBox VM: GNU/Linuxdark-eye@LOSTFor32:~$ uname -a Linux LOSTFor32 2.6.32-5-686 #1 SMP Wed Jan 11 12:29:30 UTC 2012 i686 GNU/Linux An the command I use to start volatility. Maybe there is something that I've done wrong: python vol.py --profile Linux32 --profile_file debian_squeeze.zip -f /home/dark-eye/Desktop/LF32.ram pslist Thank you again for your time and help Greetings Patrick

Hello, That's correct. I use VirtualBox to run my VMs. With VBoxManage and the debugvm command you can generate a dump of some VM information processor registers etc. This is written in an elf style format. At the end of this data structure a complete raw RAM-Dump is written, that you can easily write to a file. At some points I checked it with the information that the fmem kernel module generates an this seems to be correct. Greetings Patrick

Hello, I've done this with my System.map. This is what happens: dark-eye@Ragana:~/Sources/volatility_linux64$ unzip -p debian_squeeze.zip boot/System.map-2.6.32-5-686 | grep init_task c1083b60 T perf_event_init_task c1336980 r __ksymtab_init_task c133eef0 r __kcrctab_init_task c13431a8 r __kstrtab_init_task c1388ba0 D init_task c14322d8 B init_task_group Because I'm not really sure how to translate those virtual addresses to the offsets of the memory dump, I used volatilitux to evaluate the virtual addresses. dark-eye@Ragana:~/Sources/volatilitux$ python volatilitux.py -f /home/dark-eye/Desktop/LF32.ram -d pslist swapper comm found at 012f4e84 swapper comm found at 01388dc4 init comm found at 1f82c0f0 confirmed: swapper comm found with init's prev potential offset_parents: 312, 316 swapper_addr = 01388ba0, init_addr = 1f82c000 offset_comm = 548, offset_tasks = 240, offset_parent = 316 potential_offset_pid = 300 offset_mm = 268 offset_vmfile = 72 offset_fdentry = 12, offset_qstr = 32 offset_pgd = 36 arch = x86 Address Name PID PPID mm c1388ba0 swapper 0 0 00000000 df82c000 init 1 0 d792a380 (pgd=df8b4000) df82c440 kthreadd 2 0 00000000 So I think the c1388ba0 address is correct for the swapper not the init_task. Is this assumption right? I checked if I maybe mixed up something while dumping the memory, but can't figure out what it could be. Do you have any further ideas? Greetings Patrick

Hi Patrick, If the caching framework is causing you problems, you should always be able to disable it using the "--no-cache" flag, rather than having to manually delete the cache files. You can also set this option in the volatilityrc file so that the cache is always disabled... Mike