0

I'm trying to use volatility3 to examine a linux image which I created using LiME, I run the following command with the errors.. (I downloaded the linux.zip symbol file from the volatility repo and also placed in in /volatility/symbols)

Also tried to create my own json file using

./dwarf2json linux --system-map /boot/System.map-5.9.0-kali1-amd64 > kali.json

Please help. Thanks.

python3 vol.py -vvvvvvv -f /Linux64.mem linux.pslist.PsList                                                                                                                                1 ⨯
Volatility 3 Framework 2.0.0
INFO     root        : Volatility plugins path: ['/home/user/apps/volatility3/volatility/plugins', '/home/user/apps/volatility3/volatility/framework/plugins']
INFO     root        : Volatility symbols path: ['/home/user/apps/volatility3/volatility/symbols', '/home/user/apps/volatility3/volatility/framework/symbols']
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/plugins, /home/user/apps/volatility3/volatility/framework/plugins
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/automagic
Level 7  root        : Cache directory used: /home/user/.cache/volatility3
INFO     volatility.framework.automagic: Detected a linux category plugin
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
INFO     volatility.framework.automagic: Running automagic: ConstructionMagic
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList.vmlinux
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux
Level 9  volatility.framework.automagic.construct_layers: Failed on requirement: plugins.PsList
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 6  volatility.framework.automagic.construct_layers: Construction Exception occurred: Unexpected config value found: None
INFO     volatility.framework.automagic: Running automagic: LinuxBannerCache
Level 6  volatility.framework.symbols.intermed: Searching for symbols in /home/user/apps/volatility3/volatility/symbols, /home/user/apps/volatility3/volatility/framework/symbols
INFO     volatility.framework.automagic.symbol_cache: Building linux caches...
Level 7  volatility.framework.layers.resources: Available URL handlers: HTTPErrorProcessor, HTTPDefaultErrorHandler, HTTPRedirectHandler, ProxyHandler, HTTPBasicAuthHandler, ProxyBasicAuthHandler, HTTPDigestAuthHandler, ProxyDigestAuthHandler, AbstractHTTPHandler, HTTPHandler, HTTPSHandler, HTTPCookieProcessor, UnknownHandler, FileHandler, FTPHandler, CacheFTPHandler, DataHandler, JarHandler
INFO     volatility.framework.automagic: Running automagic: LayerStacker
Level 6  volatility.framework: Importing from the following paths: /home/user/apps/volatility3/volatility/framework/layers
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux
Level 8  volatility.framework.automagic.stacker: Attempting to stack using QemuStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using Elf64Stacker
Level 6  volatility.framework.layers.elf: Exception: Bad magic 0x4c694d45 at file offset 0x0
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LimeStacker
Level 8  volatility.framework.automagic.stacker: Stacked LimeLayer using LimeStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using QemuStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using Elf64Stacker
Level 6  volatility.framework.layers.elf: Exception: Offset 0x0 does not exist within the base layer
Level 8  volatility.framework.automagic.stacker: Attempting to stack using WindowsCrashDumpStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using VmwareStacker
Level 8  volatility.framework.automagic.stacker: Attempting to stack using LinuxIntelStacker
DEBUG    volatility.framework.automagic.linux: No suitable linux banner could be matched
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: TypeError - Layer is not the required Architecture: LimeLayer
Level 9  volatility.framework.configuration.requirements: TypeError - Layer is not the required Architecture: FileLayer
DEBUG    volatility.framework.automagic.stacker: Stacked layers: ['LimeLayer', 'FileLayer']
INFO     volatility.framework.automagic: Running automagic: LinuxSymbolFinder
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux
Level 9  volatility.framework.configuration.requirements: IndexError - No configuration provided: plugins.PsList.primary
Level 9  volatility.framework.configuration.requirements: Symbol table requirement not yet fulfilled: plugins.PsList.vmlinux

Unsatisfied requirement plugins.PsList.primary: Memory layer for the kernel
Unsatisfied requirement plugins.PsList.vmlinux: Linux kernel symbols

A symbol table requirement was not fulfilled.  Please verify that:
        You have the correct symbol file for the requirement
        The symbol file is under the correct directory or zip file
        The symbol file is named appropriately or contains the correct banner


A translation layer requirement was not fulfilled.  Please verify that:
        A file was provided to create this layer (by -f, --single-location or by config)
        The file exists and is readable
        The necessary symbols are present and identified by volatility
Unable to validate the plugin requirements: ['plugins.PsList.primary', 'plugins.PsList.vmlinux']
1

After a lot of digging, I managed to find bits and pieces that helped me resolve the issue above. Tips for running volatility3 successfully on Ubuntu or Kali:

  • Download the correct Kernel Debug Symbols (sudo apt install linux-image-xxxx-dbg) (usually located /usr/lib/debug/boot/vmlinux-xxx (elf file)
  • Download and use dwarf2json from Volatility github repository
  • Convert System.map-xxx (found in /usr/lib/debug/boot) and vmlinux (as above) to json file using the command dwarf2json linux --elf vmlinux-xxx --system-map System.map-xxx | xz -c > output.json.xz
  • Place the output.json.xz file in the volatility3/volatility/symbols, volatility3/volatility/symbols/linux and volatility3/volatility/framework/symbols directories
  • run the command python3.x vol.py -f /linux.image linux.pslist.PsList (plugin)
  • If unsuccessful try vol.py --clear-cache
  • consider using avml (microsoft memory capture binary, available for linux) to obatain memory image
  • Lastly *Ensure all dependencies for volatility are met (pycrypto, yara etc)
  • N.B. Windows memory dumps work just fine out of the box

The above should solve most issues for volatility3, tested on Ubuntu (Focal Fossa) and Kali-2020.4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy