{"action":"created","issue":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/417","repository_url":"https://api.github.com/repos/volatilityfoundation/volatility","labels_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/417/labels{/name}","comments_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/417/comments","events_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/417/events","html_url":"https://github.com/volatilityfoundation/volatility/issues/417","id":227021598,"number":417,"title":"linux_kaslr_shift on Android","user":{"login":"msaw","id":6839321,"avatar_url":"https://avatars3.githubusercontent.com/u/6839321?v=3","gravatar_id":"","url":"https://api.github.com/users/msaw","html_url":"https://github.com/msaw","followers_url":"https://api.github.com/users/msaw/followers","following_url":"https://api.github.com/users/msaw/following{/other_user}","gists_url":"https://api.github.com/users/msaw/gists{/gist_id}","starred_url":"https://api.github.com/users/msaw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msaw/subscriptions","organizations_url":"https://api.github.com/users/msaw/orgs","repos_url":"https://api.github.com/users/msaw/repos","events_url":"https://api.github.com/users/msaw/events{/privacy}","received_events_url":"https://api.github.com/users/msaw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-05-08T11:49:38Z","updated_at":"2017-05-09T15:34:46Z","closed_at":null,"body":"Hey!\r\nI'm trying to dump memory of an emulator Android x86_64, so I build a Goldfish 3.10 kernel. I create a profile like is described in the wiki ([https://github.com/volatilityfoundation/volatility/wiki/Android](url)) but for the x86_64 kernel. When I try the plugin _limeinfo_:\r\n```\r\n$ python vol.py -f lime.dump --profile=LinuxGolfish_3_10x64 limeinfo\r\nVolatility Foundation Volatility Framework 2.6\r\nNo suitable address space mapping found\r\nTried to open image as:\r\n MachOAddressSpace: mac: need base\r\n LimeAddressSpace: lime: need base\r\n WindowsHiberFileSpace32: No base Address Space\r\n WindowsCrashDumpSpace64BitMap: No base Address Space\r\n WindowsCrashDumpSpace64: No base Address Space\r\n HPAKAddressSpace: No base Address Space\r\n VMWareMetaAddressSpace: No base Address Space\r\n VirtualBoxCoreDumpElf64: No base Address Space\r\n VMWareAddressSpace: No base Address Space\r\n QemuCoreDumpElf: No base Address Space\r\n WindowsCrashDumpSpace32: No base Address Space\r\n Win10AMD64PagedMemory: No base Address Space\r\n WindowsAMD64PagedMemory: No base Address Space\r\n LinuxAMD64PagedMemory: No base Address Space\r\n AMD64PagedMemory: No base Address Space\r\n IA32PagedMemoryPae: No base Address Space\r\n IA32PagedMemory: No base Address Space\r\n OSXPmemELF: No base Address Space\r\n MachOAddressSpace: MachO Header signature invalid\r\n MachOAddressSpace: MachO Header signature invalid\r\n LimeAddressSpace: Invalid Lime header signature\r\n WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile\r\n WindowsCrashDumpSpace64BitMap: Header signature invalid\r\n WindowsCrashDumpSpace64: Header signature invalid\r\n HPAKAddressSpace: Invalid magic found\r\n VMWareMetaAddressSpace: VMware metadata file is not available\r\n VirtualBoxCoreDumpElf64: ELF Header signature invalid\r\n VMWareAddressSpace: Invalid VMware signature: 0x0\r\n QemuCoreDumpElf: ELF Header signature invalid\r\n WindowsCrashDumpSpace32: Header signature invalid\r\n Win10AMD64PagedMemory: Incompatible profile LinuxGolfish_3_10x64 selected\r\n WindowsAMD64PagedMemory: Incompatible profile LinuxGolfish_3_10x64 selected\r\n LinuxAMD64PagedMemory: Failed valid Address Space check\r\n AMD64PagedMemory: Failed valid Address Space check\r\n IA32PagedMemoryPae: Incompatible profile LinuxGolfish_3_10x64 selected\r\n IA32PagedMemory: Incompatible profile LinuxGolfish_3_10x64 selected\r\n OSXPmemELF: ELF Header signature invalid\r\n FileAddressSpace: Must be first Address Space\r\n ArmAddressSpace: Failed valid Address Space check\r\n```\r\n\r\nI tried the plugin linux_kaslr_shift but without success:\r\n\r\n```\r\n$ python vol.py -f lime.dump --profile=LinuxGolfish_3_10x64 linux_kaslr_shift \r\nVolatility Foundation Volatility Framework 2.6\r\nDTB                Virtual Shift      Physical Shift    \r\n------------------ ------------------ ------------------\r\nTraceback (most recent call last):\r\n  File \"/opt/volatility/volatility/vol.py\", line 192, in <module>\r\n    main()\r\n  File \"/opt/volatility/volatility/vol.py\", line 183, in main\r\n    command.execute()\r\n  File \"/opt/volatility/volatility/volatility/plugins/linux/common.py\", line 67, in execute\r\n    commands.Command.execute(self, *args, **kwargs)\r\n  File \"/opt/volatility/volatility/volatility/commands.py\", line 147, in execute\r\n    func(outfd, data)\r\n  File \"/opt/volatility/volatility/volatility/plugins/linux/kaslr_shift.py\", line 187, in render_text\r\n    for shift_combination in data:\r\n  File \"/opt/volatility/volatility/volatility/plugins/linux/kaslr_shift.py\", line 115, in calculate\r\n    shift = profile.shift_address\r\nAttributeError: 'LinuxGolfish_3_10x64' object has no attribute 'shift_address'\r\n```\r\nI tried also pass \"timeout=0\" to lime.\r\nCan anyone help me please\r\nThank you"},"comment":{"url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/comments/300203373","html_url":"https://github.com/volatilityfoundation/volatility/issues/417#issuecomment-300203373","issue_url":"https://api.github.com/repos/volatilityfoundation/volatility/issues/417","id":300203373,"user":{"login":"msaw","id":6839321,"avatar_url":"https://avatars3.githubusercontent.com/u/6839321?v=3","gravatar_id":"","url":"https://api.github.com/users/msaw","html_url":"https://github.com/msaw","followers_url":"https://api.github.com/users/msaw/followers","following_url":"https://api.github.com/users/msaw/following{/other_user}","gists_url":"https://api.github.com/users/msaw/gists{/gist_id}","starred_url":"https://api.github.com/users/msaw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msaw/subscriptions","organizations_url":"https://api.github.com/users/msaw/orgs","repos_url":"https://api.github.com/users/msaw/repos","events_url":"https://api.github.com/users/msaw/events{/privacy}","received_events_url":"https://api.github.com/users/msaw/received_events","type":"User","site_admin":false},"created_at":"2017-05-09T15:34:45Z","updated_at":"2017-05-09T15:34:45Z","body":"@bneuburg thank you for your response, but your solution doesn't work! :( \r\nI tried also with Goldfish 3.10 x86 but still have the same. "}}
{"actor":{"display_login":"msaw"}}