{"action":"created","issue":{"url":"https://api.github.com/repos/google/rekall/issues/173","repository_url":"https://api.github.com/repos/google/rekall","labels_url":"https://api.github.com/repos/google/rekall/issues/173/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/173/comments","events_url":"https://api.github.com/repos/google/rekall/issues/173/events","html_url":"https://github.com/google/rekall/issues/173","id":171050926,"number":173,"title":"Inconsistency during profile lookup and inventory generation","user":{"login":"veyesecurity","id":16190843,"avatar_url":"https://avatars.githubusercontent.com/u/16190843?v=3","gravatar_id":"","url":"https://api.github.com/users/veyesecurity","html_url":"https://github.com/veyesecurity","followers_url":"https://api.github.com/users/veyesecurity/followers","following_url":"https://api.github.com/users/veyesecurity/following{/other_user}","gists_url":"https://api.github.com/users/veyesecurity/gists{/gist_id}","starred_url":"https://api.github.com/users/veyesecurity/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/veyesecurity/subscriptions","organizations_url":"https://api.github.com/users/veyesecurity/orgs","repos_url":"https://api.github.com/users/veyesecurity/repos","events_url":"https://api.github.com/users/veyesecurity/events{/privacy}","received_events_url":"https://api.github.com/users/veyesecurity/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-14T09:44:00Z","updated_at":"2016-08-22T23:19:01Z","closed_at":null,"body":"Hi,\r\nwhile adding new linux profile to the system I've followed the rules described in FAQ/rekall_list. There are several things that should be addressed in that process:\r\n\r\n- it should be stated that profile naming before rekall import must be [kernel_name].zip otherwise auto detection (`guess_profile.py (616)`) will not find it. Or `manage_repo` should rename the profile according to rekall chosen naming convention.\r\n- `manage_repo` will generate rekall profile from `./v1.0/src/Linux/[Distro]/[kernel_name].zip` and place it in `./v1.0/Linux/[Distro]/[kernel_name].zip`, but when dealing with `Debian` distros, auto detection will look in `./v1.0/Debian`. This approach breaks the analysis (`guess_profile.py (613)`) stating that profile is not in the inventory.\r\n\r\nI'm not submitting any pull requests right now (not problem to do it). I'm interested to hear your opinion on the topic before actually do any coding."},"comment":{"url":"https://api.github.com/repos/google/rekall/issues/comments/241580431","html_url":"https://github.com/google/rekall/issues/173#issuecomment-241580431","issue_url":"https://api.github.com/repos/google/rekall/issues/173","id":241580431,"user":{"login":"scudette","id":3856546,"avatar_url":"https://avatars.githubusercontent.com/u/3856546?v=3","gravatar_id":"","url":"https://api.github.com/users/scudette","html_url":"https://github.com/scudette","followers_url":"https://api.github.com/users/scudette/followers","following_url":"https://api.github.com/users/scudette/following{/other_user}","gists_url":"https://api.github.com/users/scudette/gists{/gist_id}","starred_url":"https://api.github.com/users/scudette/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scudette/subscriptions","organizations_url":"https://api.github.com/users/scudette/orgs","repos_url":"https://api.github.com/users/scudette/repos","events_url":"https://api.github.com/users/scudette/events{/privacy}","received_events_url":"https://api.github.com/users/scudette/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T23:19:01Z","updated_at":"2016-08-22T23:19:01Z","body":"I suspect you are relying on the banner scanner for autodetection (https://github.com/google/rekall/blob/master/rekall-core/rekall/plugins/guess_profile.py#L590).\r\n\r\nThis scanner searches for something that looks like a banner and tries to open the corresponding profile. The banner detector is not very reliable and in fact will frequently fail. The standard way to autodetect a linux image is with the linux profile index. The index entry will find the right profile regardless of its name where-ever it gets put in the repo.\r\n\r\nIn order for the profile index to work though you need to have /proc/kallsyms either because you are running live on the system or that file was also acquired into the aff4 image.\r\n\r\nI think it is expected that autodetection of linux images is not going to work unless you have a proper aff4 image with /proc/kallsyms. Maybe we should allow the user to specify an external /proc/kallsyms outside the image in case you acquires that separately.\r\n\r\nNote that if you already know the profile you can just specify it in the command line directly.\r\n"}}
{"actor":{"display_login":"scudette"}}