volatilityfoundation / volatility

An advanced memory forensics framework
http://volatilityfoundation.org/
GNU General Public License v2.0
7.3k stars 1.28k forks source link

Invalid profile <Linux ARM profile name> selected #692

Open anafsah opened 4 years ago

anafsah commented 4 years ago

I am working with a Linux ARM arhcitecture qemu-based virtual machine. I am able to successfully create a new profile. But when I use the profile with the plugins, such as linux_pslist, I get this error message: ERROR : volatility.debug : Invalid profile LinuxdebianArm3_2ARM selected

Command: vol.py -f ./11234-xyz.dd --plugins=./volitilityProfiles --profile=LinuxdebianArm3_2ARM linux_pslist Output: Volatility Foundation Volatility Framework 2.6.1 ERROR : volatility.debug : Invalid profile LinuxdebianArm3_2ARM selected

Additional information:

  1. info vol.py --plugins=/home/afsah/Desktop/volitilityProfiles --info | grep Linux Volatility Foundation Volatility Framework 2.6.1 LinuxdebianArm3_2ARM - A Profile for Linux debianArm3.2 ARM linux_aslr_shift - Automatically detect the Linux ASLR shift linux_banner - Prints the Linux banner information linux_yarascan - A shell in the Linux memory image LinuxAMD64PagedMemory - Linux-specific AMD 64-bit address space.

  2. imageinfo Command: vol.py --plugins=./volitilityProfiles imageinfo -f 11234-xyz.dd Volatility Foundation Volatility Framework 2.6.1 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : No suggestion (Instantiated with LinuxdebianArm3_2ARM) AS Layer1 : ArmAddressSpace (Kernel AS) AS Layer2 : FileAddressSpace (/home/afsah/Desktop/pandasReplay/qemuOutputs /qemuArm/18567a65fa07ae1b88de7f2e9d0717d8/11234-xyz.dd) PAE type : No PAE DTB : 0x4000L

  3. I followed the steps outlined in the documentation to create a new profile. Create new profile documentation

atcuno commented 4 years ago

Is this for 32 or 64 bit ARM?