-
Notifications
You must be signed in to change notification settings - Fork 383
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
When scanning linux lime memory file, use the config file created by --save-config, can not skip the scan LimeLayer step. Is this normal behavior? #1119
Comments
Unfortunately it depends on the requirements of the plugin (whether it has a The config supplements volatility's automagic, so that if the additional information doesn't help, it'll fall back to doing the scans itself. As far as I was aware, this had all been working, but it's possible a recent change broke this or there's some other reason why it can't skip past the scan... |
When I use linux.iomem to analyze 66.local.lime, the content of the generated config file is as follows: |
@ikelos Are you still following this issue? |
Sorry, I haven't had much time to devote to volatility recently, but I am still following it yes. That configuration is using the |
When scanning a 24G windows lime memeory file,I can use --save-config option to create config file . The next time I scan this memory file, I can use the -c option set saved config to skip the Scanning memory_layer step.
But when scanning a 16G Linux lime memory file, I followed the same steps and could not skip the Scanning LimeLayer step.
Save config command:
python C:\Users\typer\work\volatility3-develop\vol.py -vvvv --save-config C:\Users\typer\temp\66.conf -f D:\66.raw linux.iomem
-c set config file command:
python C:\Users\typer\work\volatility3-develop\vol.py -vvvv -c C:\Users\typer\temp\66.conf -f D:\66.raw linux.iomem
output before start Scanning LimeLayer:
Is this the normal behavior of volatility3? Or did I do something wrong?
The text was updated successfully, but these errors were encountered: