下载源码

git clone https://github.com/volatilityfoundation/volatility.git

Requirements

Python 2.6 or later, but not 3.0
一些插件，请查看
https://github.com/volatilityfoundation/volatility/wiki/Installation

[root@localhost volatility]# python -V
Python 2.7.5

安装pip，python-devel

#Python 2.7
curl https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
#安装pip
python get-pip.py
#升级pip
python -m pip install -U pip

yum install python-devel

安装依赖

pip install distorm3 pycrypto

准备linux profiles

如果没有适配的Profile，就要自己编写了

git clone https://github.com/volatilityfoundation/profiles.git

将profiles/Linux/CentOS/x64/Centos7-3.10.0-327.36.3.el7.x86_64.zip拷贝到volatility/volatility/plugins/overlays/linux目录，然后解压unzip Centos7-3.10.0-327.36.3.el7.x86_64.zip。
再次查看支持的Profiles

[root@localhost volatility]# python vol.py --info |more
Volatility Foundation Volatility Framework 2.6.1


Profiles
--------
LinuxCentos7-3_10_0-327_36_3_el7_x86_64x64 - A Profile for Linux Centos7-3.10.0-327.36.3.el7.x86_64 x64
VistaSP0x64                                - A Profile for Windows Vista SP0 x64
VistaSP0x86                                - A Profile for Windows Vista SP0 x86

自己编译profiles

Linux · volatilityfoundation/volatility Wiki · GitHub

安装依赖工具

yum install libdwarf-tools,gcc

编译
进入volatility/tools/linux/目录，该目录下有需要的Makefile文件

make -C /lib/modules/$(uname -r)/build CONFIG_DEBUG_INFO=y M=$PWD modules

[root@localhost linux]# ls
kcore  Makefile  Makefile.enterprise  module.c

[root@localhost linux]# make -C /lib/modules/$(uname -r)/build CONFIG_DEBUG_INFO=y M=$PWD modules
make: Entering directory `/usr/src/kernels/3.10.0-1160.36.2.el7.x86_64'
  CC [M]  /root/volatility/tools/linux/module.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /root/volatility/tools/linux/module.mod.o
  LD [M]  /root/volatility/tools/linux/module.ko
make: Leaving directory `/usr/src/kernels/3.10.0-1160.36.2.el7.x86_64'

[root@localhost linux]# ls
kcore  Makefile  Makefile.enterprise  module.c  module.ko  module.mod.c  module.mod.o  module.o  modules.order  Module.symvers

dwarfdump -di ./module.o > module.dwarf

[root@localhost linux]# dwarfdump -di ./module.o > module.dwarf
[root@localhost linux]# ls
kcore  Makefile  Makefile.enterprise  module.c  module.dwarf  module.ko  module.mod.c  module.mod.o  module.o  modules.order  Module.symvers

将 module.dwarf 和 /boot/System.map-$(uname -r) 打包

[root@localhost linux]# zip CentOS_3.10.0-1160.zip module.dwarf /boot/System.map-$(uname -r)
  adding: module.dwarf (deflated 89%)
  adding: boot/System.map-3.10.0-1160.36.2.el7.x86_64 (deflated 79%)
[root@localhost linux]# ls
CentOS_3.10.0-1160.zip  kcore  Makefile  Makefile.enterprise  module.c  module.dwarf  module.ko  module.mod.c  module.mod.o  module.o  modules.order  Module.symvers

分析

将刚才生成的profile文件 CentOS_3.10.0-1160.zip 拷贝到/root/volatility/volatility/plugins/overlays/linux/目录，并解压unzip CentOS_3.10.0-1160.zip
检查profile是否生效

[root@localhost volatility]# python vol.py --info |more
Volatility Foundation Volatility Framework 2.6.1

Profiles
--------
LinuxCentOS_3_10_0-1160x64 - A Profile for Linux CentOS_3.10.0-1160 x64
VistaSP0x64                - A Profile for Windows Vista SP0 x64
...

分析文件

[root@localhost volatility]# python vol.py  -f /root/ram.lime --profile LinuxCentOS_3_10_0-1160x64 linux_banner
Volatility Foundation Volatility Framework 2.6.1
Linux version 3.10.0-1160.36.2.el7.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Wed Jul 21 11:57:15 UTC 2021