MagnetForensics / dumpit-linux

Memory acquisition for Linux that makes sense.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Running it on GNU/Linux Endaevour os With 6.4+ KERNEL doesn't work

lordofwizard opened this issue · comments

logs

[2023-07-25T02:50:48Z INFO  dumpitforlinux] Reconstructed ELF header length is 0x4000.
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Creating .tar.zst archive...
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Writing /proc/kallsyms file...
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Writing kcore.ram-dump.6.4.2-zen1-1-zen.2023-07-25-0250.core file...
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Writing 0x1000-0x87000 physical block...
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Writing 0x88000-0xa0000 physical block...
[2023-07-25T02:50:48Z INFO  dumpitforlinux] Writing 0x100000-0x9b00000 physical block...
[2023-07-25T02:50:49Z INFO  dumpitforlinux] Writing 0x9e00000-0x9f00000 physical block...
[2023-07-25T02:50:49Z INFO  dumpitforlinux] Writing 0x9f0b000-0x8cf99000 physical block...
[2023-07-25T02:51:01Z INFO  dumpitforlinux] Writing 0x8e199000-0x9ac71000 physical block...
[2023-07-25T02:51:03Z INFO  dumpitforlinux] Writing 0x9acc9000-0xab3af000 physical block...
[2023-07-25T02:51:04Z INFO  dumpitforlinux] Writing 0xaf7ff000-0xaf800000 physical block...
[2023-07-25T02:51:04Z INFO  dumpitforlinux] Writing 0x100000000-0x1cf000000 physical block...
███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████░░░░░░ 3348103168/3472883712[2023-07-25T02:51:23Z ERROR dumpitforlinux::error] Bad address (os error 14)
Error: IoError("Bad address (os error 14)")

Doesn't work on generic Linux kernel nor Zen kernel.

Downgrading to linux6.2.1 worked. maybe /proc/kcore memory address ranges have been altered in recent versions of linuxkernel