linux.pslist returns no results

[RafaelAybar]

Volatily 3 is not able to find plugins
I made a memory dump with Lime in raw format, and i wanted to process it with Volatility3. I have installed all dependencies even the optional dependencies.

Context
Volatility Version: Volatility 3 Framework 2.0.0 Beta
Operating System: Debian Testign
Python Version: 3.9.1
Kernel Version: 5.9.0.5-amd64
Command: python3 vol.py -vvvv -s symbols/ --file /linux.mem linux.bash.Bash

To Reproduce
1- Run a python3 setup.py install
2- Generate JSON file with dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-5.9.0.5-amd64 > output.json

Expected behavior
Volatility3 shoud find the plugins

Command output

https://pastebin.com/vdW3s7Ar

[ikelos]

So this has nothing to with the plugins. It clearly says that it can't determine the information it needs to load the layer (and therefore can't find the symbols it might need). When using dwarf2json you should also use the System.map, because the debugging kernel may not contain all the necessary symbols. You can then also check that the symbols you've created (output.json) live in the volatility/symbols/linux directory, and show up in the output of the isfinfo plugin (this can take a long time to run if you have lots of symbol files). Once it's in there, you should see which banner it's looking for, and you can then run the banners plugin against your image and see if any of the banners it finds match the ones in the ISF file. Please report back the results of these steps, and if you're still experiencing difficulty after that... 5:)

[RafaelAybar]

Hi, tanks a lot for your fast answer, i uncompressed the linux.zip file, and commpresed the folder linux with output.json in order to generate another linux.zip file. Also, i have installed jsonschema beacuse it's another dependency.

Here you are the logs: https://pastebin.com/681Jv8yW

[ikelos]

Ok, it looks like the symbol file is loaded correctly. Now you have to check your memory image to make sure that the banner (Linux version 5.9.0-5-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-1) 10.2.1 20201207, GNU ld (GNU Binutils for Debian) 2.35.1) #1 SMP Debian 5.9.15-1 (2020-12-17)) appears exactly within the memory image, otherwise volatility won't decide to use it. I'd recommend trying the banners plugin to see if volatility can find anything similar within the image. Please remember, it must match exactly for volatility to make use of it...

[RafaelAybar]

Hi again, i have tried to run the banner plugin, but i am too confused, i will generate another memory dump with Lime using the current Kernel, here you are the logs. https://pastebin.com/ZqJePSPD

[ikelos]

Well, the output from banners matches the output.json file you made, so it should be finding that within the memory image? I'm not sure how to debug this further without a copy of the memory image?

[RafaelAybar]

Okey, can I send you an email with the memory dump throug gdrive or wetransfer?

[ikelos]

Hiya, you can share it via gdrive with mike.auty@gmail.com and I'll pick it up. I can let you know once I've got it...

[ikelos]

Thanks I can confirm I've got it. I'll try to find some time to look at it in the next couple of week...

[ikelos]

Hiya, I've managed to take a look into this, but I'm having difficulty tracking down the packages needed for this kernel. I found one with a matching kernel, but it was built with a different compiler for backports. Ever jiggering the banner constant_data didn't allow it to output any data (which is likely due to a system.map that doesn't match the system we're analyzing. Would you be able to provide the JSON file you said that you generated from the original linux-kernel-dbg package please?

[RafaelAybar]

Yes of course!

[No-Github]

I have the same problem, is there a further solution?

python3 vol.py -vvvv -s volatility3/framework/symbols/linux/ isfinfo

python3 vol.py -vvvv -f cyq.vmem banners

python3 vol.py -vvvv -f cyq.vmem linux.bash.Bash

python3 vol.py -vvvv -c /pentest/volatility3/volatility3/framework/symbols/linux/Ubuntu1804.json -f cyq.vmem linux.bash.Bash

python3 vol.py -vvvv -s volatility3/framework/symbols/linux/ -f cyq.vmem linux.bash.Bash