"ArmAddressSpace - EXCEPTION: 'state'"

[RubaAlsmadi]

Hi,

I'm trying to dump an Arch Linux memory using Volatility 2, and I got the following error : Unsatisfied requirement plugins.PsList.kernel.layer_name: Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

A translation layer requirement was not fulfilled. Please verify that: A file was provided to create this layer (by -f, --single-location or by config) The file exists and is readable The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled. Please verify that: The associated translation layer requirement was fulfilled You have the correct symbol file for the requirement The symbol file is under the correct directory or zip file The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']

I started solving this by running this command dwarf2json linux --elf [path to debug kernel] > [kernel name].json

I found the VMLinux system map in the Arch Linux device but could not find the debug kernel. I started creating a new profile for Arch Linux, and I was able to create a new profile, and I can see the profile. However, when I try to use the profile, it fails with an error.

In the KBUILD_CLFAGS I made these changes.

ifdef CONFIG_DEBUG_INFO DEBUG_CFLAGS += -gsplit-dwarf -gdwarf-4 endif

The initial error has gone away, but the modules haven't run successfully. ` WARNING : volatility.debug : Overlay structure cpuinfo_x86 not present in vtypes Offset Name Pid PPid Uid Gid DTB Start Time

---

No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64BitMap: No base Address Space VMWareMetaAddressSpace: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space VMWareAddressSpace: No base Address Space QemuCoreDumpElf: No base Address Space WindowsCrashDumpSpace32: No base Address Space SkipDuplicatesAMD64PagedMemory: No base Address Space WindowsAMD64PagedMemory: No base Address Space LinuxAMD64PagedMemory: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space OSXPmemELF: No base Address Space MachOAddressSpace: MachO Header signature invalid MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile WindowsCrashDumpSpace64BitMap: Header signature invalid VMWareMetaAddressSpace: VMware metadata file is not available WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF Header signature invalid VMWareAddressSpace: Invalid VMware signature: - QemuCoreDumpElf: ELF Header signature invalid WindowsCrashDumpSpace32: Header signature invalid SkipDuplicatesAMD64PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected WindowsAMD64PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected LinuxAMD64PagedMemory - EXCEPTION: 'state' AMD64PagedMemory - EXCEPTION: 'state' IA32PagedMemoryPae: Incompatible profile Linuxubuntu22_04x64 selected IA32PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected OSXPmemELF: ELF Header signature invalid FileAddressSpace: Must be first Address Space ArmAddressSpace - EXCEPTION: 'state' To solve the state exception, I used this state_offset = profile.get_obj_offset("task_struct", "state")

    try:
        # For Linux kernels < v5.14-rc1
        state_offset  = profile.get_obj_offset("task_struct", "state")
    except:
        # For Linux kernels >= v5.14-rc1, based on commit 2f064a59a11ff9bc22e52e9678bc601404c7cb34
        state_offset  = profile.get_obj_offset("task_struct", "__state")

`

but in this case I stop seeing the profiles that I created.

``