volatilityfoundation-volatility

Linux support in Volatility
===========================

Linux support in Volatility requires a set of information tailored to the running kernel
as well as the System map file. Volatility calls this system specific information
a "profile".

For linux a profile file is simply a zip file which contains:

- A copy of the System.map file.
- DWARF debugging symbols from the kernel.

Then including the Distro.zip profile in the volatility plugins directory,
you can make use of it as follows:

vol.py --profile LinuxDistro linux_pslist


How to get debugging symbols easily
-----------------------------------

It is always possible to download the debug kernel, or more simply just build a
debug module.

For example, in this directory type:

tools/linux$ make
make -C //lib/modules/2.6.32-8-generic/build CONFIG_DEBUG_INFO=y M=.../tools/linux modules
make[1]: Entering directory `/usr/src/linux-headers-2.6.32-8-generic'
  CC [M]  ..../tools/linux/module.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      ..../tools/linux/module.mod.o
  LD [M]  ..../tools/linux/module.ko
make[1]: Leaving directory `/usr/src/linux-headers-2.6.32-8-generic'

tools/linux$ dwarfdump -di module.ko > module.dwarf
tools/linux$ zip Distro.zip module.dwarf /boot/System.map-2.6.32-8-generic

Now we have the Distro.zip file.