Linux Profile Error - KeyError: 'DW_AT_data_member_location' #828
Comments
|
I've got the exact same issue. |
|
Same here :/ |
|
Same issue！Maybe the Volatility Version issue，this standalone might have some problem. |
|
Volatility Foundation Volatility Framework 2.4 Volatility 2.4.0 have the same issue. |
|
I have found what the issue is. The DWARF data generated seems to be using the DWARFv5 or newer version which Volatility 2 is not able to interpret. Adding "-gdwarf-4" to KBUILD_CLFAGS in the root Makefile in the kernel source tree solves the issue. Before: ifdef CONFIG_DEBUG_INFO
KBUILD_CFLAGS += -g
KBUILD_AFLAGS += -gdwarf-2
endifAfter: ifdef CONFIG_DEBUG_INFO
KBUILD_CFLAGS += -g -gdwarf-4
KBUILD_AFLAGS += -gdwarf-2
endifThis is a manual solution, requiring changes every time a new profile needs to be generated. |
Could you kindly where the Makefile is located in the kernel source tree please? The closest I found was the one shown below but it does not have what you mentioned above. I tried including this part: But I still got the same error as already reported above.
|
You have found the correct makefile, it should be the top makefile in the kernel source tree. In your case, the addition should be on the line where its written: DEBUG_CFLAGS += -gThat is: if As an alternative, based on the version of the kernel you are using, setting |
|
Thank you for your reply. 👍 |
|
Hi @mthbrown , thanks for solving the issue. How did you import the .zip profile into volatility 3 as you did for volatility 2? Thanks |
|
@Metjuw @miszr Did it end up working on newer kernels? Although I no longer get the same error, it runs but gives EXCEPTIONS and can't find the base address: This is on Ubuntu 22.04 and kernel 5.15.0-53 and this is the section in the ifdef CONFIG_DEBUG_INFO_SPLIT
DEBUG_CFLAGS += -gsplit-dwarf
else
DEBUG_CFLAGS += -g
DEBUG_CFLAGS += -gdwarf-4
endifI also had to comment out these lines as otherwise it give me the # ifndef CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
# dwarf-version-$(CONFIG_DEBUG_INFO_DWARF4) := 4
# dwarf-version-$(CONFIG_DEBUG_INFO_DWARF5) := 5
# DEBUG_CFLAGS += -gdwarf-$(dwarf-version-y)
# endifAnd here is the bash script I used to build it: #!/bin/bash
cd tools/linux/
make clean
make
cd ../../../
zip ubuntu22.04.zip volatility/tools/linux/module.dwarf /boot/System.map-`uname -r`
mv ubuntu22.04.zip profiles/
cd volatility/
python2 vol.py --plugins=/home/vagrant/profiles/ --profile=Linuxubuntu22_04x64 -f /home/vagrant/output.lime linux_pslistAny ideas? Thanks |
|
@transcend3nt You basically have to:
You are now good to go |
|
Same issue. I think vol 2 just don't support new kernel now. |
|
@mthbrown Same issue here too. I'm on a 5.15.0 kernel. |
|
Same issue here too. I'm on a 5.19.0-42-generic kernel. Vol2 definetely does not support the new kernel. We basically have to try to go to volatility3 and try to build custom symbol files. |
Your solution is only valid for Volatility 3. It does not work for Volatility 2 since it uses profiles instead of symbol files. |
|
@miszr Thanks but I'm still getting the same error even after installing your PR (kernel 5.15.0-53) Here is a quick way to reproduce the issue. Just start a Vagrant box and run it: |
|
@mthbrown: Could you please attempt to use the following patch with the Makefile used in the tools/linux directory: --- Makefile.orig 2023-06-13 07:38:03.065860789 +0200
+++ Makefile 2023-05-29 12:43:40.823489421 +0200
@@ -7,7 +7,7 @@
all: dwarf
dwarf: module.c
- $(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build CONFIG_DEBUG_INFO=y M="$(PWD)" modules
+ $(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build CONFIG_DEBUG_INFO=y CONFIG_DEBUG_INFO_DWARF4=y M="$(PWD)" modules
dwarfdump -di module.ko > module.dwarf
$(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build M="$(PWD)" clean |
|
@miszr Still didn't work. Here's the obj-m += module.o
KDIR ?= /
KVER ?= $(shell uname -r)
-include version.mk
all: dwarf
dwarf: module.c
$(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build CONFIG_DEBUG_INFO=y CONFIG_DEBUG_INFO_DWARF4=y M="$(PWD)" modules
dwarfdump -di module.ko > module.dwarf
$(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build M="$(PWD)" clean
clean:
$(MAKE) -C $(KDIR)/lib/modules/$(KVER)/build M="$(PWD)" clean
rm -f module.dwarf |
This should resolve issue volatilityfoundation#828
|
@miszr The initial error has gone away but modules don't run successfully. For example: |
|
@miszr I'm a little confused. So should I apply both PRs to get it to work? |
|
@mthbrown: That is correct. These are two separate issues solved by two separate PRs. Original issue is related with the DWARF debug information being of a newer version than Volatility 2 could handle. That is solved in PR #854. The exception issue is caused by a field being renamed in a struct. This is solved by PR #852. |
|
@miszr Looks like it works :) Will try to test it more with other plugins Thanks a lot By the way, I noticed that you mentioned that this is for kernels >= 5.14-rc1. Does this mean that kernels in 5.x that aren't greater than .14 aren't supported? |
|
@mthbrown: Great to hear that it works. All Linux kernels, as far as I have tested, work with the PRs i have created. PR #852 adds support for newer kernels. Older kernels work as before. Basically PR #852 attempts to use the old method(looking for a field called Once your satisfied with your testing. Please close this issue to indicate that it has been solved. |
|
Tried it out on a 6.x kernel. Unfortunately, it is back to not finding the base address. This is on Ubuntu 22.04 with a mainline kernel (6.3.7) installed |
|
@mthbrown: Just did a test with Ubuntu 23.04 with kernel 6.3.7-060307 running in VirtualBox and performing a memory dump using the debugvm and dumpvmcore commands. Everything worked as intended. Maybe your memory dump is somehow incorrect? Mark this issue as solved but do not close it, as it still affects the master branch of volatility 2. |
I have also problem with Linux Profile Error - KeyError: 'DW_AT_data_member_location' but I use Ubuntu 6.2.0-36 generic and can't find the line in the Makefile where I'm supposed to do this change. |
See the following comments: |
Hi,
I'm currently trying to run Volatility 2 on a custom profile for Ubuntu 22.04. I successfully created the profile by running:
and I can see the profile when I run:
However, when I try to use the profile, it fails with this error:
and for the binary version as well:
I ran into this error for memory captures from both LiME (including with and without the
timeout=0option as mentioned here and AVML. I attached the profile - ubuntu22.04.zip.Any ideas? Thanks.
UPDATE I was able to successfully run the equivalent command on Volatility 3 by creating a custom Symbols Table that I attached
vmlinux-5.15.0-33-generic.json.gz but I would rather run it on Volatility 2 due to the extra plugins available on Volatility 2
The text was updated successfully, but these errors were encountered: