Problem with Volati...
 
Notifications
Clear all

Problem with Volatility imageinfo on Kali Linux

1 Posts
1 Users
0 Reactions
2,421 Views
(@duyvo)
New Member
Joined: 8 years ago
Posts: 1
Topic starter  

I'm using Volatility's imageinfo function on Kali Linux to identify the profile of the memory image which I capture from VMware Windows 7 32-bit. However, the output of Volatility not as my expected with no profile as below. I created some memory images by Belkasoft RAM Capturer and FTK Imager Lite. The results were the same. I also tried with another memory image from the Internet which I'm pretty sure the author was success with Volatility imageinfo.

root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump2.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump2.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/memdump3.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/memdump3.mem)
PAE type No PAE
root@kali/usr/share/volatility# python vol.py imageinfo -f ~/Desktop/20170903.mem
Volatility Foundation Volatility Framework 2.6
INFO volatility.debug Determining profile based on KDBG search...
Suggested Profile(s) No suggestion (Instantiated with no profile)
AS Layer1 FileAddressSpace (/root/Desktop/20170903.mem)
PAE type No PAE
root@kali/usr/share/volatility#


   
Quote
Share: