Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to create a profile outside of a running system? #81

Open
MureDanta opened this issue Aug 19, 2020 · 0 comments
Open

How to create a profile outside of a running system? #81

MureDanta opened this issue Aug 19, 2020 · 0 comments

Comments

@MureDanta
Copy link

MureDanta commented Aug 19, 2020

I'm trying to do some memory analysis on an embedded Linux system. Due to storage constraints there is no /lib/modules/version/build available, but I do have the kernel configuration file and system map, so what I've done is download the kernel source from kernel.org and build that using the kernel configuration file from the embedded system. Then, in tools/linux/ execute

make -C ${KP} CONFIG_DEBUG_INFO=y M="$PWD" modules
dwarfdump -di module.ko >module.dwarf

where ${KP} is the path to the kernel build directory. Then package module.dwarf and the system map from the running system into a zip archive and copy that to volatility/plugins/overlays/linux/. This seems to work OK, or at least I see my profile in the --info list. But when I try to use the profile with a LiME image and the linux_pslist command, I get errors like this:

(lots of messages about missing Crypto.Hash and distorm3 plugins)
WARNING : volatility.debug    : Overlay structure cpuinfo_x86 not present in vtypes
WARNING : volatility.debug    : Overlay structure vm_area_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure tty_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure sockaddr_un not present in vtypes
WARNING : volatility.debug    : Overlay structure hlist_head not present in vtypes
WARNING : volatility.debug    : Overlay structure task_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure dentry not present in vtypes
WARNING : volatility.debug    : Overlay structure net_device not present in vtypes
WARNING : volatility.debug    : Overlay structure super_block not present in vtypes
WARNING : volatility.debug    : Overlay structure in_ifaddr not present in vtypes
WARNING : volatility.debug    : Overlay structure cpuinfo_x86 not present in vtypes
WARNING : volatility.debug    : Overlay structure vm_area_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure tty_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure sockaddr_un not present in vtypes
WARNING : volatility.debug    : Overlay structure hlist_head not present in vtypes
WARNING : volatility.debug    : Overlay structure task_struct not present in vtypes
WARNING : volatility.debug    : Overlay structure dentry not present in vtypes
WARNING : volatility.debug    : Overlay structure net_device not present in vtypes
WARNING : volatility.debug    : Overlay structure super_block not present in vtypes
WARNING : volatility.debug    : Overlay structure in_ifaddr not present in vtypes
Offset             Name                 Pid             PPid            Uid             Gid    DTB                Start Time
------------------ -------------------- --------------- --------------- --------------- ------ ------------------ ----------
No suitable address space mapping found
Tried to open image as:
 MachOAddressSpace: mac: need base
 LimeAddressSpace: lime: need base

and all the other address space modules also report no base address. Originally I thought the problem might be my LiME module (the embedded system has no build tools, so I had to follow a similar process to build the LiME kernel module), but the WARNING messages about being unable to find this or that kernel data structure makes me wonder if the problem is in my profile? I wondered if anyone had some ideas/hints?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant