You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug kernel_cap_struct still required despite 713b5f9
Context
Volatility Version: 18e5d7a
Dwarf2Json version: 15baf31210af272dc2b79ba79a6e58abc5d0336b
OS: Linux version 6.5.0-14-generic (buildd@lcy02-amd64-031) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.41) #14-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 14 14:59:49 UTC 2023 (Ubuntu 6.5.0-14.14-generic 6.5.3)
Example output
DEBUG volatility3.framework.automagic.linux: Identified banner: b'Linux version 6.5.0-14-generic (buildd@lcy02-amd64-031) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.41) #14-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 14 14:59:49 UTC 2023 (Ubuntu 6.5.0-14.14-generic 6.5.3)\n\x00'Level 7 volatility3.framework.automagic.stacker: Exception during stacking: Symbol type not in LintelStacker1 SymbolTable: kernel_cap_structLevel 6 volatility3.framework.automagic.stacker: Traceback (most recent call last): File "/opt/vol/volatility3/volatility3/framework/automagic/stacker.py", line 216, in stack_layer new_layer = stacker.stack(context, initial_layer, progress_callback) File "/opt/vol/volatility3/volatility3/framework/automagic/linux.py", line 72, in stack table = linux.LinuxKernelIntermedSymbols( File "/opt/vol/volatility3/volatility3/framework/symbols/linux/__init__.py", line 32, in __init__ self.set_type_class("kernel_cap_struct", extensions.kernel_cap_struct) File "/opt/vol/volatility3/volatility3/framework/symbols/intermed.py", line 60, in _delegate_function return getattr(self._delegate, name)(*args, **kwargs) File "/opt/vol/volatility3/volatility3/framework/symbols/intermed.py", line 425, in set_type_class raise ValueError(f"Symbol type not in {self.name} SymbolTable: {name}")ValueError: Symbol type not in LintelStacker1 SymbolTable: kernel_cap_structLevel 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.ProgList.kernel.layer_nameLevel 9 volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayerDEBUG volatility3.framework.automagic.stacker: physical_layer maximum_address: 1073741823DEBUG volatility3.framework.automagic.stacker: Stacked layers: ['FileLayer']INFO volatility3.framework.automagic: Running automagic: SymbolFinderINFO volatility3.framework.automagic: Running automagic: LinuxSymbolFinderLevel 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.ProgList.kernel.symbol_table_nameINFO volatility3.framework.automagic: Running automagic: KernelModuleLevel 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.ProgList.kernel.layer_nameLevel 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.ProgList.kernel.symbol_table_nameLevel 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.ProgList.kernel.layer_nameLevel 9 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.ProgList.kernel.layer_nameLevel 9 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.ProgList.kernel.symbol_table_nameUnsatisfied requirement plugins.ProgList.kernel.layer_name:Unsatisfied requirement plugins.ProgList.kernel.symbol_table_name:A translation layer requirement was not fulfilled. Please verify that: A file was provided to create this layer (by -f, --single-location or by config) The file exists and is readable The file is a valid memory image and was acquired cleanlyA symbol table requirement was not fulfilled. Please verify that: The associated translation layer requirement was fulfilled You have the correct symbol file for the requirement The symbol file is under the correct directory or zip file The symbol file is named appropriately or contains the correct bannerUnable to validate the plugin requirements: ['plugins.ProgList.kernel.layer_name', 'plugins.ProgList.kernel.symbol_table_name']
Additional information
On the latest Ubuntu 23.10 I still get the error due to the change in capability types discussed in #985
I guess this is since self.set_type_class("kernel_cap_struct", extensions.kernel_cap_struct) was not removed in the PR.
The text was updated successfully, but these errors were encountered:
vobst
changed the title
kernel_cap_struct still required despite https://github.com/volatilityfoundation/volatility3/pull/997kernel_cap_struct still required despite #997
Dec 19, 2023
Describe the bug
kernel_cap_struct
still required despite 713b5f9Context
Volatility Version: 18e5d7a
Dwarf2Json version: 15baf31210af272dc2b79ba79a6e58abc5d0336b
OS:
Linux version 6.5.0-14-generic (buildd@lcy02-amd64-031) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.41) #14-Ubuntu SMP PREEMPT_DYNAMIC Tue Nov 14 14:59:49 UTC 2023 (Ubuntu 6.5.0-14.14-generic 6.5.3)
Example output
Additional information
On the latest Ubuntu 23.10 I still get the error due to the change in capability types discussed in #985
I guess this is since
self.set_type_class("kernel_cap_struct", extensions.kernel_cap_struct)
was not removed in the PR.The text was updated successfully, but these errors were encountered: