Issue when analyzing LiME dump from Android 15 AVD.

[BinsIT]

When running the linux.pslist plugin against a memory dump from a custom Android 15 kernel (Linux version 6.6.30-android15-8), Volatility 3 reports:

Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

The plugin cannot load the kernel translation layer or symbol table, even though a kernel symbol file is present.

Volatility Version: 2.27.0
Operating System: Windows 10/11/Ubuntu 24.04.03
Python Version: Python 3.10.0 / newest python
Suspected Operating System: Android 15 custom kernel x86_64
Command:

python vol.py -f "memory.lime" -v linux.pslist

Steps to reproduce the behavior:

Acquire a memory dump (memory.lime) from an Android Virtual Device x86_64 with custom kernel 6.6.30-android15-8 using adb pull.

Have the kernel symbols JSON file located at the Volatility symbols directory.

Run the command to load the process list plugin.

See error indicating unsatisfied kernel layer and symbol table requirements.

Expected behavior

The plugin should successfully load the kernel layer and symbols, displaying the list of running processes.

Example output

C:\Users\me\Desktop\Voltality 3 Develop\volatility3>python vol.py -f "C:\Users\me\Desktop\Voltality 3 Develop\memory.lime" -v linux.pslist
INFO     volatility3.cli: Volatility plugins path: ['C:\\Users\\me\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\plugins', 'C:\\Users\\me\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\framework\\plugins']
INFO     volatility3.cli: Volatility symbols path: ['C:\\Users\\me\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\symbols', 'C:\\Users\\me\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\framework\\symbols']
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.plugins.yarascan: Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available
INFO     volatility3.cli: The following plugins could not be loaded (use -vv to see why): volatility3.plugins.linux.vmayarascan, volatility3.plugins.windows.cachedump, volatility3.plugins.windows.direct_system_calls, volatility3.plugins.windows.hashdump, volatility3.plugins.windows.indirect_system_calls, volatility3.plugins.windows.lsadump, volatility3.plugins.windows.malware.direct_system_calls, volatility3.plugins.windows.malware.indirect_system_calls, volatility3.plugins.windows.mftscan, volatility3.plugins.windows.registry.cachedump, volatility3.plugins.windows.registry.hashdump, volatility3.plugins.windows.registry.lsadump, volatility3.plugins.windows.vadyarascan, volatility3.plugins.yarascan
Volatility 3 Framework 2.27.0
INFO     volatility3.framework.automagic: Detected a linux category plugin
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
INFO     volatility3.framework.automagic: Running automagic: SymbolCacheMagic
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
INFO     volatility3.framework.automagic: Running automagic: SymbolFinder
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
INFO     volatility3.framework.automagic: Running automagic: KernelModule

Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

A translation layer requirement was not fulfilled.  Please verify that:
        A file was provided to create this layer (by -f, --single-location or by config)
        The file exists and is readable
        The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled.  Please verify that:
        The associated translation layer requirement was fulfilled
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']

Additional information

Memory dump obtained via adb pull from Android emulator with virtual device x86_64 and custom Android 15 kernel.

Kernel symbols manually generated or extracted from build system and placed in Volatility’s symbols directory.

Banner mismatch or incomplete symbol support for this custom kernel may be causing the issue.

[ikelos]

This feels as though it's a duplicate of #1892, but you've provided less information this time? You've helped us debug issues like this in that ticket, why did you open a new one and not provide -vvv output? If you don't provide us the appropriate information, or worse, duplicate issues you've already opened, that's going to divert developer time and attention away from actually fixing your problem, and towards writing long boring answers like this.

Please provide the output from your run with the -vvv flag or if this isn't a new bug, please close it and try to avoid filing duplicate bugs.

[BinsIT]

Its not same issue, i download fix for your resolve ,and now it doesnt works again.

[ikelos]

Then please provide the output with the -vvv as asked for when reporting bugs.

[BinsIT]

Hello! I analyze my memory output again.
I patched code of vol3 develop branch in few steps - by fixing module_sect_attr error and few comparing errors
Now i've got :

C:\Users\user\Desktop\Voltality 3 Develop\volatility3>python vol.py -vvvvvv -f "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" --symbol-dirs "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\symbols" --single-location "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" linux.pslist.PsList
INFO     volatility3.cli: Volatility plugins path: ['C:\\Users\\user\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\plugins', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\framework\\plugins']
INFO     volatility3.cli: Volatility symbols path: ['C:\\Users\\user\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\symbols', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\symbols', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\volatility3\\volatility3\\framework\\symbols']
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\plugins, C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\plugins
DEBUG    volatility3.plugins.yarascan: Using yara-python module
DEBUG    volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\automagic
Volatility 3 Framework 2.27.0
DETAIL 3 volatility3.cli: Cache directory used: C:\Users\user\AppData\Roaming\volatility3
INFO     volatility3.framework.automagic: Detected a linux category plugin
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework.automagic.construct_layers: Construction Exception occurred: Unexpected config value found: None
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
INFO     volatility3.framework.automagic: Running automagic: SymbolCacheMagic
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\symbols
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 3 volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler
DETAIL 4 volatility3.framework.layers.resources: UNC path detected, converted path file://///C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime to file:///////C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Stacked LimeLayer using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelVMCOREINFOStacker
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\symbols
DEBUG    volatility3.framework.automagic.linux: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan  1 00:00:00 UTC 1970\n\x00'
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility3.schemas: All validations will report success, even with malformed input
DEBUG    volatility3.framework.automagic.linux: Values found in VMCOREINFO: KASLR=0x1dc00000, ASLR=0x2e400000, DTB=0x20e3c000
DETAIL 2 volatility3.framework.automagic.stacker: Stacked primary using LinuxIntelVMCOREINFOStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer.base_layer
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework.layers.resources: UNC path detected, converted path file://///C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime to file:///////C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\layers
DEBUG    volatility3.framework.automagic.stacker: physical_layer maximum_address: 2146905151
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['primary', 'LimeLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: SymbolFinder
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG    volatility3.framework.automagic.symbol_finder: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan  1 00:00:00 UTC 1970\n\x00'
DEBUG    volatility3.framework.automagic.symbol_finder: Using symbol library: file:///C:/Users/user/Desktop/Voltality%203%20Develop/volatility3/volatility3/symbols/android-kernel-symbols.json
INFO     volatility3.schemas: Dependency for validation unavailable: jsonschema
DEBUG    volatility3.schemas: All validations will report success, even with malformed input
DEBUG    volatility3.framework.automagic.symbol_finder: producer_name: dwarf2json, producer_version: 0.9.0
DEBUG    volatility3.framework.automagic.symbol_finder: Types:
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'dwarf', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
DEBUG    volatility3.framework.automagic.symbol_finder: Symbols:
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'dwarf', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'symtab', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
INFO     volatility3.framework.automagic: Running automagic: KernelModule
DEBUG    volatility3.cli: Successfully constructed linux.pslist.PsList (4, 1, 1)
DETAIL 3 volatility3.cli.text_filter: Filters:
[]

OFFSET (V)      PID     TID     PPID    COMM    UID     GID     EUID    EGID    CREATION TIME   File output
Traceback (most recent call last):
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\vol.py", line 11, in <module>
    volatility3.cli.main()
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\cli\__init__.py", line 934, in main
    CommandLine().run()
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\cli\__init__.py", line 522, in run
    renderer.render(grid)
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\cli\text_renderer.py", line 329, in render
    grid.populate(visitor, outfd)
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\renderers\__init__.py", line 318, in populate
    for level, item in self._generator:
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\plugins\linux\pslist.py", line 213, in _generator
    for task in self.list_tasks(
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\plugins\linux\pslist.py", line 280, in list_tasks
    for task in init_task.thread_group.to_list(
  File "C:\Users\user\Desktop\Voltality 3 Develop\volatility3\volatility3\framework\objects\__init__.py", line 993, in __getattr__
    raise AttributeError(
AttributeError: StructType has no attribute: symbol_table_name1!task_struct.thread_group

Thank you very much for your assistance.

Best regards.

[Abyss-W4tcher]

Hi @BinsIT, did you apply any modification to linux/pslist.py file?

The line for task in init_task.thread_group.to_list( is not present in the latest version of volatility3:

https://github.com/volatilityfoundation/volatility3/blob/develop/volatility3/framework/plugins/linux/pslist.py#L280

[BinsIT]

Yes,i did.

[Abyss-W4tcher]

I'm not sure that we'll be able to help you with a modified vol3 installation. Have you tried using the latest pslist.py version?

[BinsIT]

Yes i tried to use latest pslist.py version but it doesnt work. I download it from lastest develop branch,but program shows previous error (module sect attr). If u would like to fix it , i will be glad.

[Abyss-W4tcher]

The module_sect_attr fix will soon be pushed to develop. Can you try the following in the meantime, after saving your current custom branch:

git checkout develop
git pull

git checkout -b my_tmp_branch
git fetch origin 'pull/1773/head:issue_1761_module_sect_attr_fix'
git merge --squash issue_1761_module_sect_attr_fix

And then re-run analysis

[BinsIT]

C:\Users\user\Desktop\Voltality 3 Develop\vol3develop>python vol.py -vvvvvv -f "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" --symbol-dirs "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json" --single-location "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" linux.pslist.PsList
INFO volatility3.cli: Volatility plugins path: ['C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\plugins', 'C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\plugins']
INFO volatility3.cli: Volatility symbols path: ['C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json', 'C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols', 'C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols']
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\plugins, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\plugins
DEBUG volatility3.plugins.yarascan: Using yara-python module
DEBUG volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic
Volatility 3 Framework 2.27.0
DETAIL 3 volatility3.cli: Cache directory used: C:\Users\user\AppData\Roaming\volatility3
INFO volatility3.framework.automagic: Detected a linux category plugin
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
INFO volatility3.framework.automagic: Running automagic: ConstructionMagic
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\uiser\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework.automagic.construct_layers: Construction Exception occurred: Unexpected config value found: None
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
INFO volatility3.framework.automagic: Running automagic: SymbolCacheMagic
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols
INFO volatility3.framework.automagic: Running automagic: LayerStacker
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 3 volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler, S3FileSystemHandler, GSFileSystemHandler, LeechCoreHandler
DETAIL 4 volatility3.framework.layers.resources: UNC path detected, converted path file://///C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime to file:///////C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Stacked LimeLayer using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelVMCOREINFOStacker
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols
DEBUG volatility3.framework.automagic.linux: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan 1 00:00:00 UTC 1970\n\x00'
DEBUG volatility3.schemas: Validating JSON against schema...
DEBUG volatility3.schemas: JSON validated against schema (result cached)
DETAIL 3 volatility3.framework.automagic.stacker: Exception during stacking: Symbol type not in LintelStacker1 SymbolTable: socket
DETAIL 4 volatility3.framework.automagic.stacker: Traceback (most recent call last):

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic\stacker.py", line 219, in stack_layer
new_layer = stacker.stack(context, initial_layer, progress_callback)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic\linux.py", line 337, in stack
table = linux.LinuxKernelIntermedSymbols(

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\linux_init_.py", line 81, in init
self.set_type_class("socket", extensions.network.socket)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\intermed.py", line 60, in _delegate_function
return getattr(self._delegate, name)(*args, **kwargs)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\intermed.py", line 446, in set_type_class
raise ValueError(f"Symbol type not in {self.name} SymbolTable: {name}")

ValueError: Symbol type not in LintelStacker1 SymbolTable: socket

DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
DEBUG volatility3.framework.automagic.linux: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan 1 00:00:00 UTC 1970\n\x00'
DETAIL 3 volatility3.framework.automagic.stacker: Exception during stacking: Symbol type not in LintelStacker1 SymbolTable: socket
DETAIL 4 volatility3.framework.automagic.stacker: Traceback (most recent call last):

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic\stacker.py", line 219, in stack_layer
new_layer = stacker.stack(context, initial_layer, progress_callback)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic\linux.py", line 58, in stack
table = linux.LinuxKernelIntermedSymbols(

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\linux_init_.py", line 81, in init
self.set_type_class("socket", extensions.network.socket)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\intermed.py", line 60, in _delegate_function
return getattr(self._delegate, name)(*args, **kwargs)

File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols\intermed.py", line 446, in set_type_class
raise ValueError(f"Symbol type not in {self.name} SymbolTable: {name}")

ValueError: Symbol type not in LintelStacker1 SymbolTable: socket

DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: LimeLayer
DETAIL 1 volatility3.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayer
DEBUG volatility3.framework.automagic.stacker: physical_layer maximum_address: 2146905151
DEBUG volatility3.framework.automagic.stacker: Stacked layers: ['LimeLayer', 'FileLayer']
INFO volatility3.framework.automagic: Running automagic: SymbolFinder
INFO volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
INFO volatility3.framework.automagic: Running automagic: KernelModule
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name

Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled. Please verify that:
The associated translation layer requirement was fulfilled
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']

Now theres something like this. Vol3 doesnt find symbols for socket.

[Abyss-W4tcher]

The kernel you are analyzing does not have the expected "socket" structure. This is similar to this issue:

#1090 (comment)

You can set "optional_set_type_class" here:

volatility3/volatility3/framework/symbols/linux/__init__.py

Line 80 in a17281a

self.set_type_class("socket", extensions.network.socket)

and here:

volatility3/volatility3/framework/symbols/linux/network.py

Line 18 in a17281a

symbol_table.set_type_class("socket", network.socket)

[BinsIT]

Thanks a lot. Now i fix this lines:

symbol_table.optional_set_type_class("socket", network.socket)
symbol_table.optional_set_type_class("inet_sock", network.inet_sock)
symbol_table.optional_set_type_class("unix_sock", network.unix_sock)

and output is :

C:\Users\user\Desktop\Voltality 3 Develop\vol3develop>python vol.py -vvvvvv -f "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" --symbol-dirs "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json" --single-location "C:\Users\user\Desktop\Voltality 3 Develop\memory.lime" linux.pslist.PsList
INFO     volatility3.cli: Volatility plugins path: ['C:\\Users\\user\\Desktop\\Voltality 3 Develop\\vol3develop\\volatility3\\plugins', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\vol3develop\\volatility3\\framework\\plugins']
INFO     volatility3.cli: Volatility symbols path: ['C:\\Users\\user\\Desktop\\Voltality 3 Develop\\vol3develop\\volatility3\\symbols\\android-kernel-symbols.json', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\vol3develop\\volatility3\\symbols', 'C:\\Users\\user\\Desktop\\Voltality 3 Develop\\vol3develop\\volatility3\\framework\\symbols']
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\plugins, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\plugins
DEBUG    volatility3.plugins.yarascan: Using yara-python module
DEBUG    volatility3.plugins.renderers.parquet_renderer: Arrow/Parquet libraries not found
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\automagic
Volatility 3 Framework 2.27.0
DETAIL 3 volatility3.cli: Cache directory used: C:\Users\user\AppData\Roaming\volatility3
INFO     volatility3.framework.automagic: Detected a linux category plugin
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
INFO     volatility3.framework.automagic: Running automagic: ConstructionMagic
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework.automagic.construct_layers: Construction Exception occurred: Unexpected config value found: None
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
INFO     volatility3.framework.automagic: Running automagic: SymbolCacheMagic
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols
INFO     volatility3.framework.automagic: Running automagic: LayerStacker
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 3 volatility3.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, VolatilityHandler, JarHandler, OfflineHandler, S3FileSystemHandler, GSFileSystemHandler, LeechCoreHandler
DETAIL 4 volatility3.framework.layers.resources: UNC path detected, converted path file://///C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime to file:///////C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Bad magic 0x4c694d45 at file offset 0x0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Stacked LimeLayer using LimeStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelVMCOREINFOStacker
DETAIL 4 volatility3.framework.symbols.intermed: Searching for symbols in C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols\android-kernel-symbols.json, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\symbols, C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\symbols
DEBUG    volatility3.framework.automagic.linux: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan  1 00:00:00 UTC 1970\n\x00'
DEBUG    volatility3.framework.automagic.linux: Values found in VMCOREINFO: KASLR=0x1dc00000, ASLR=0x2e400000, DTB=0x20e3c000
DETAIL 2 volatility3.framework.automagic.stacker: Stacked primary using LinuxIntelVMCOREINFOStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using AVMLStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using Elf64Stacker
DETAIL 4 volatility3.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using XenCoreDumpStacker
DETAIL 4 volatility3.framework.layers.xen: Exception: Offset 0x0 does not exist within the base layer
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using QemuStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 4 volatility3.framework.layers.crash: Exception reading crashdump: Crashdump header not found at offset 0
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using VmwareStacker
DETAIL 2 volatility3.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.kernel.layer_name.memory_layer.base_layer
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework.layers.resources: UNC path detected, converted path file://///C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime to file:///////C:/Users/user/Desktop/Voltality%203%20Develop/memory.lime
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.kernel
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DETAIL 1 volatility3.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DETAIL 4 volatility3.framework: Importing from the following paths: C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\layers
DEBUG    volatility3.framework.automagic.stacker: physical_layer maximum_address: 2146905151
DEBUG    volatility3.framework.automagic.stacker: Stacked layers: ['primary', 'LimeLayer', 'FileLayer']
INFO     volatility3.framework.automagic: Running automagic: SymbolFinder
INFO     volatility3.framework.automagic: Running automagic: LinuxSymbolFinder
DETAIL 1 volatility3.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.kernel.symbol_table_name
DEBUG    volatility3.framework.automagic.symbol_finder: Identified banner: b'Linux version 6.6.30-android15-8-android15-8-maybe-dirty (kleaf@build-host) (Android (11368308, +pgo, +bolt, +lto, +mlgo, based on r510928) clang version 18.0.0 (https://android.googlesource.com/toolchain/llvm-project 477610d4d0d988e69dbc3fae4fe86bff3f07f2b5), LLD 18.0.0) #1 SMP PREEMPT Thu Jan  1 00:00:00 UTC 1970\n\x00'
DEBUG    volatility3.framework.automagic.symbol_finder: Using symbol library: file:///C:/Users/user/Desktop/Voltality%203%20Develop/vol3develop/volatility3/symbols/android-kernel-symbols.json
DEBUG    volatility3.framework.automagic.symbol_finder: producer_name: dwarf2json, producer_version: 0.9.0
DEBUG    volatility3.framework.automagic.symbol_finder: Types:
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'dwarf', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
DEBUG    volatility3.framework.automagic.symbol_finder: Symbols:
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'dwarf', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
DEBUG    volatility3.framework.automagic.symbol_finder:         {'kind': 'symtab', 'name': 'vmlinux', 'hash_type': 'sha256', 'hash_value': '5e98df50d5b909c5879d2f5cfea58e4bf8ac461afe654a4ec958e460e164ec86'}
INFO     volatility3.framework.automagic: Running automagic: KernelModule
DEBUG    volatility3.cli: Successfully constructed linux.pslist.PsList (4, 1, 1)
DETAIL 3 volatility3.cli.text_filter: Filters:
[]

OFFSET (V)      PID     TID     PPID    COMM    UID     GID     EUID    EGID    CREATION TIME   File output
Traceback (most recent call last):
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\vol.py", line 11, in <module>
    volatility3.cli.main()
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\cli\__init__.py", line 934, in main
    CommandLine().run()
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\cli\__init__.py", line 522, in run
    renderer.render(grid)
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\cli\text_renderer.py", line 329, in render
    grid.populate(visitor, outfd)
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\renderers\__init__.py", line 318, in populate
    for level, item in self._generator:
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\plugins\linux\pslist.py", line 213, in _generator
    for task in self.list_tasks(
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\plugins\linux\pslist.py", line 270, in list_tasks
    for task in init_task.tasks.to_list(
  File "C:\Users\user\Desktop\Voltality 3 Develop\vol3develop\volatility3\framework\objects\__init__.py", line 993, in __getattr__
    raise AttributeError(
AttributeError: StructType has no attribute: symbol_table_name1!bd_openers.tasks

[Abyss-W4tcher]

Did you compile the kernel yourself? If not, can you provide the symbols file here please?

[BinsIT]

Yes i compiled the kernel.
But i wanted to send you privatly this kernel with my kernel-ranchu file and .config to check in this all files.
I can put if on my Google Drive or something with password.