search

volatilityfoundation / volatility

An advanced memory forensics framework
http://volatilityfoundation.org/
GNU General Public License v2.0
7.04k stars 1.26k forks source link

profile issue in Ubuntu 21.04 while using volatility 2.6 #861

Open shakti1cr7 opened 9 months ago

shakti1cr7 commented 9 months ago

I am trying to run thr below command but it is giving me error:

ubuntu@ubuntu-2204:~/Desktop/volatility$ python2 vol.py -f firefox1.dmp --profile=LinuxUbuntu2204-620x64 linux_psscan Volatility Foundation Volatility Framework 2.6 WARNING : volatility.debug : Overlay structure cpuinfo_x86 not present in vtypes WARNING : volatility.debug : Overlay structure cpuinfo_x86 not present in vtypes Offset Name Pid PPid Uid Gid DTB Start Time

No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64BitMap: No base Address Space VMWareMetaAddressSpace: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareAddressSpace: No base Address Space QemuCoreDumpElf: No base Address Space WindowsCrashDumpSpace32: No base Address Space Win10AMD64PagedMemory: No base Address Space WindowsAMD64PagedMemory: No base Address Space LinuxAMD64PagedMemory: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space OSXPmemELF: No base Address Space MachOAddressSpace: MachO Header signature invalid MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64BitMap: Header signature invalid VMWareMetaAddressSpace: VMware metadata file is not available WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF Header signature invalid VMWareAddressSpace: Invalid VMware signature: 0x905c689 QemuCoreDumpElf: ELF Header signature invalid WindowsCrashDumpSpace32: Header signature invalid Win10AMD64PagedMemory: Incompatible profile LinuxUbuntu2204-620x64 selected WindowsAMD64PagedMemory: Incompatible profile LinuxUbuntu2204-620x64 selected LinuxAMD64PagedMemory - EXCEPTION: 'init_level4_pgt' AMD64PagedMemory - EXCEPTION: 'init_level4_pgt' IA32PagedMemoryPae: Incompatible profile LinuxUbuntu2204-620x64 selected IA32PagedMemory: Incompatible profile LinuxUbuntu2204-620x64 selected OSXPmemELF: ELF Header signature invalid FileAddressSpace: Must be first Address Space ArmAddressSpace - EXCEPTION: 'init_level4_pgt'

I have tried installing all the libaries and dependency in Ubuntu but still getting abov error. Could someone look into this issue?

ikelos commented 9 months ago

Dwarf2json is used for volatility 3, and is not relevant/used by volatility 2. Transferring this issue....