volatilityfoundation / profiles

Volatility profiles for Linux and Mac OS X

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

No Suitable Address space mapping Found

jwrb2g16 opened this issue · comments

Hi,

I get the error 'No suitable address space mapping found' when I try to run the following command
sudo python vol.py -f dump2.raw --profile="LinuxUbuntu1204x64" linux_pslist

I have generated the memory dump using Lime with the following command
insmod LiME/src/lime-4.4.0-130-generic.ko "path=dump2.raw format=lime"

I have tried formats raw, padded and lime all to no luck.

I have created the profile on installation of Volatility, my linux kernel version is 4.4.0-130-generic, is this version supported?

Here is my error in full
`Volatility Foundation Volatility Framework 2.6
Offset Name Pid PPid Uid Gid DTB Start Time


No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VMWareMetaAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareAddressSpace: No base Address Space
QemuCoreDumpElf: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
WindowsCrashDumpSpace64BitMap: Header signature invalid
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VMWareMetaAddressSpace: VMware metadata file is not available
VirtualBoxCoreDumpElf64: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: 0x0
QemuCoreDumpElf: ELF Header signature invalid
WindowsCrashDumpSpace32: Header signature invalid
SkipDuplicatesAMD64PagedMemory: Incompatible profile LinuxUbuntu1204x64 selected
WindowsAMD64PagedMemory: Incompatible profile LinuxUbuntu1204x64 selected
LinuxAMD64PagedMemory: Failed valid Address Space check
AMD64PagedMemory: Failed valid Address Space check
IA32PagedMemoryPae: Incompatible profile LinuxUbuntu1204x64 selected
IA32PagedMemory: Incompatible profile LinuxUbuntu1204x64 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
`