11:38 p.m.
Mike - thanks so much for replying
***************************************************************************************************
This is the terminal output for the lipo commands:
qbl-mbp:~ qubyte$ lipo -info /usr/local/lib/libewf.dylib
Non-fat file: /usr/local/lib/libewf.dylib is architecture: x86_64
qbl-mbp:~ qubyte$ lipo -info `which python`
Architectures in the fat file:
/Library/Frameworks/Python.framework/Versions/2.6/bin/python are: ppc i386
***************************************************************************************************
Output from from the versioner command:
qbl-mbp:volatility2.0 qubyte$ VERSIONER_PYTHON_PREFER_32_BIT=yes python
vol.py -h
Volatile Systems Volatility Framework 2.0
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
I have also cc'd Joachim Metz on this in case he has some insight. Joachim
- in case you have time to read this i am encountering this error with
libewf and volatility 2.0 when running volatitlity (mac ox 10.6.8 with
libewf 20100226; this version of libewf is used to due to TSK 3.2.2):
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
Thanks to the vol group and joachim for taking the time to read this! I
look forward to the next set of ideas! :)
Cheers
Shafik
On Tue, Aug 9, 2011 at 11:00 AM, <vol-users-request(a)volatilityfoundation.org>wrote:
lipo -info `which python`
12:30 a.m.
New subject: Vol-users Digest, Vol 39, Issue 1
Shafik,
My guess is that MacOS-X requires arch x86_64 to be included.
Try adding "-arch x86_64" when building libewf.
mac ox 10.6.8 with libewf 20100226; this version of
libewf is used to due
to TSK 3.2.
FYI I've there are patches available on the TSK trackers to have TSK also
support newer alphas of libewf.
Joachim
On Wed, Aug 10, 2011 at 05:38, Shafik Punja <shafghp(a)gmail.com> wrote:
Mike - thanks so much for replying
***************************************************************************************************
This is the terminal output for the lipo commands:
qbl-mbp:~ qubyte$ lipo -info /usr/local/lib/libewf.dylib
Non-fat file: /usr/local/lib/libewf.dylib is architecture: x86_64
qbl-mbp:~ qubyte$ lipo -info `which python`
Architectures in the fat file:
/Library/Frameworks/Python.framework/Versions/2.6/bin/python are: ppc i386
***************************************************************************************************
Output from from the versioner command:
qbl-mbp:volatility2.0 qubyte$ VERSIONER_PYTHON_PREFER_32_BIT=yes python
vol.py -h
Volatile Systems Volatility Framework 2.0
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
I have also cc'd Joachim Metz on this in case he has some insight. Joachim
- in case you have time to read this i am encountering this error with
libewf and volatility 2.0 when running volatitlity (mac ox 10.6.8 with
libewf 20100226; this version of libewf is used to due to TSK 3.2.2):
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
Thanks to the vol group and joachim for taking the time to read this! I
look forward to the next set of ideas! :)
Cheers
Shafik
On Tue, Aug 9, 2011 at 11:00 AM,
<vol-users-request(a)volatilityfoundation.org>wrote:
lipo -info `which python`
2:32 a.m.
New subject: Vol-users Digest, Vol 39, Issue 1
Hiya Shafik,
So from your output, it looks as though libewf.dylib is built for 64-bit
systems, whereas the python you're running is built for ppc or i386
versions. As Joachim said, you'll need to rebuild libewf, but you need
to build it to match python's i386 architecture. I guess that would be
"-arch i386", but that's just a guess.
Since we've determined that python's already running in i386 mode, you
won't need to force it to run in that mode by using the versioner
environment variable.
The other option is to get a pre-built python that's compiled for x86_64
and use that. Either one should solve your problem. Hope that helps...
Mike 5:)
2:42 a.m.
New subject: Vol-users Digest, Vol 39, Issue 1
Mike,
Thanks for the correction,
Apparently I'm not entirely awake yet ;-)
Joachim
On Wed, Aug 10, 2011 at 08:32, Mike Auty <mike.auty(a)gmail.com> wrote:
Hiya Shafik,
So from your output, it looks as though libewf.dylib is built for 64-bit
systems, whereas the python you're running is built for ppc or i386
versions. As Joachim said, you'll need to rebuild libewf, but you need
to build it to match python's i386 architecture. I guess that would be
"-arch i386", but that's just a guess.
Since we've determined that python's already running in i386 mode, you
won't need to force it to run in that mode by using the versioner
environment variable.
The other option is to get a pre-built python that's compiled for x86_64
and use that. Either one should solve your problem. Hope that helps...
Mike 5:)
10:35 p.m.
New subject: Vol-users Digest, Vol 39, Issue 1
Thanks Mike and Joachim that worked and resolved the issue!
On Wed, Aug 10, 2011 at 12:42 AM, Joachim Metz <joachim.metz(a)gmail.com>wrote:
Mike,
Thanks for the correction,
Apparently I'm not entirely awake yet ;-)
Joachim
On Wed, Aug 10, 2011 at 08:32, Mike Auty <mike.auty(a)gmail.com> wrote:
Hiya Shafik,
So from your output, it looks as though libewf.dylib is built for 64-bit
systems, whereas the python you're running is built for ppc or i386
versions. As Joachim said, you'll need to rebuild libewf, but you need
to build it to match python's i386 architecture. I guess that would be
"-arch i386", but that's just a guess.
Since we've determined that python's already running in i386 mode, you
won't need to force it to run in that mode by using the versioner
environment variable.
The other option is to get a pre-built python that's compiled for x86_64
and use that. Either one should solve your problem. Hope that helps...
Mike 5:)
4844
days inactive
4845
days old
vol-users@lists.volatilityfoundation.org
4 comments
3 participants
participants (3)
-
Joachim Metz -
Mike Auty -
Shafik Punja