mirror of
https://github.com/volatilityfoundation/volatility
synced 2026-06-08 18:04:46 +00:00
mike.auty@gmail.com
40 lines
1.3 KiB
Plaintext
40 lines
1.3 KiB
Plaintext
Linux support in Volatility
|
|
===========================
|
|
|
|
Linux support in Volatility requires a set of information tailored to the running kernel
|
|
as well as the System map file. Volatility calls this system specific information
|
|
a "profile".
|
|
|
|
For linux a profile file is simply a zip file which contains:
|
|
|
|
- A copy of the System.map file.
|
|
- DWARF debugging symbols from the kernel.
|
|
|
|
Then including the Distro.zip profile in the volatility plugins directory,
|
|
you can make use of it as follows:
|
|
|
|
vol.py --profile LinuxDistro linux_pslist
|
|
|
|
|
|
How to get debugging symbols easily
|
|
-----------------------------------
|
|
|
|
It is always possible to download the debug kernel, or more simply just build a
|
|
debug module.
|
|
|
|
For example, in this directory type:
|
|
|
|
tools/linux$ make
|
|
make -C //lib/modules/2.6.32-8-generic/build CONFIG_DEBUG_INFO=y M=.../tools/linux modules
|
|
make[1]: Entering directory `/usr/src/linux-headers-2.6.32-8-generic'
|
|
CC [M] ..../tools/linux/module.o
|
|
Building modules, stage 2.
|
|
MODPOST 1 modules
|
|
CC ..../tools/linux/module.mod.o
|
|
LD [M] ..../tools/linux/module.ko
|
|
make[1]: Leaving directory `/usr/src/linux-headers-2.6.32-8-generic'
|
|
|
|
tools/linux$ dwarfdump -di module.ko > module.dwarf
|
|
tools/linux$ zip Distro.zip module.dwarf /boot/System.map-2.6.32-8-generic
|
|
|
|
Now we have the Distro.zip file. |