I am using Volatility Framework 2.2 to anlayze a Linux memory dump.
This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23
I have the profile for it and you can find it at the link below.
http://www.sendspace.com/file/pqyipd
I have placed this zip file in the location: /volatility/plugins/overlays/linux
below is the output of the command:
python vol.py --info | grep Linux
LinuxUbuntu1204x64 - A Profile for Linux Ubuntu1204 x64
now I use this profile to analyze the memory dump:
python vol.py --profile=LinuxUbuntu1204x64 -f mem.dump linux_pslist
and I get a blank output!
$ python vol.py --profile=LinuxUbuntu1204x64 -f mem.dump linux_pslist
Volatile Systems Volatility Framework 2.2
Offset Name Pid Uid Start Time
------------------ -------------------- --------------- --------------- ----------
it does not give me the list of processes
I have tried this with another memory dump as well and same output.
I am trying it on a linux memory dump provided in a recent CTF, ebCTF 2013 forensics challenge.
You can find the write up here:
http://blog.lse.epita.fr/articles/59-ebctf-2013-for100.html
I am using the same profile provided by this user however in my case it does not work.
Any idea why would I get a blank output?
Thanks.