I'm using Volatility's imageinfo function on Kali Linux to identify the profile of the memory image which I capture from VMware Windows 7 32-bit. However, the output of Volatility not as my expected with no profile as below. I created some memory images by Belkasoft RAM Capturer and FTK Imager Lite. The results were the same. I also tried with another memory image from the Internet which I'm pretty sure the author was success with Volatility imageinfo.
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump2.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump2.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump3.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump3.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/20170903.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/20170903.mem)
PAE type No PAE
root@kali/usr/share/volatility#
Notifications
Clear all
Topic starter
05/09/2017 7:05 pm