Cannot build volatility profile for Android Omap project
i have a Samsung Galaxy memory image which i have extracted using LiME. I
wanna use volatility to analyze this memory file, however i am unable to
analyze anything, all i get are address space errors.
So from what i understand, i must zip up the module.dwarf file, as well as
the System.map file from the source code.
As the System.map file did not exist, i created it using the following
command:
#nm /root/majorProject/omap/arch/arm/boot/compressed/vmlinux > System.map
Then i did the zipping of the relevant files with the following commands:
#zip Omaptesting.zip
/root/majorProject/androidVolatility/volatility/tools/linux/module.dwarf
/root/majorProject/omap/arch/arm/boot/compressed/System.map
I verified that the profile was created with the following command:
#python vol.py --info | grep Linux
Volatile Systems volatility Framework 2.3_beta
linux_yarascan - A shell in the Linux memory image
LinuxOmaptestingx86 - A Profile for Linux Omaptesting x86
But when i tried to get the pslist with the following command, i got nothing:
python vol.py --profile=LinuxOmaptestingx86 -f /root/majorProject/ram.lime
linux_pslist
All i get are just simply address space errors. Any idea how to resolve
this? Thanks. :)
No comments:
Post a Comment