{"action":"opened","issue":{"url":"https://api.github.com/repos/google/rekall/issues/450","repository_url":"https://api.github.com/repos/google/rekall","labels_url":"https://api.github.com/repos/google/rekall/issues/450/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/450/comments","events_url":"https://api.github.com/repos/google/rekall/issues/450/events","html_url":"https://github.com/google/rekall/issues/450","id":380520874,"node_id":"MDU6SXNzdWUzODA1MjA4NzQ=","number":450,"title":"\"Unable to find valid profile for this image\" even when I explicitly specify my own profile","user":{"login":"YourDaddyIsHere","id":16850039,"node_id":"MDQ6VXNlcjE2ODUwMDM5","avatar_url":"https://avatars0.githubusercontent.com/u/16850039?v=4","gravatar_id":"","url":"https://api.github.com/users/YourDaddyIsHere","html_url":"https://github.com/YourDaddyIsHere","followers_url":"https://api.github.com/users/YourDaddyIsHere/followers","following_url":"https://api.github.com/users/YourDaddyIsHere/following{/other_user}","gists_url":"https://api.github.com/users/YourDaddyIsHere/gists{/gist_id}","starred_url":"https://api.github.com/users/YourDaddyIsHere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YourDaddyIsHere/subscriptions","organizations_url":"https://api.github.com/users/YourDaddyIsHere/orgs","repos_url":"https://api.github.com/users/YourDaddyIsHere/repos","events_url":"https://api.github.com/users/YourDaddyIsHere/events{/privacy}","received_events_url":"https://api.github.com/users/YourDaddyIsHere/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-14T03:31:35Z","updated_at":"2018-11-14T03:31:35Z","closed_at":null,"author_association":"NONE","body":"I create a profile follow the two step routine (first create a zip file with module.c and system map, then use convert_profile command to create the json file)\r\n\r\n\r\n\r\nI use LiME to dump the machines own memory into a .mem file, and then use rekall to analyze it, the command and errors are below (fullmem.mem and 3.10.0-862.14.4.el7.x86_64.json are both in /root)(The OS is CentOS7 with kernel 3.10.0-862.14.4.el7.x86_64, the dump and analysis are in the same machine):\r\n\r\n\r\n\r\n[root@localhost ~]# rekal -f fullmem.mem --profile 3.10.0-862.14.4.el7.x86_64.json -p /root\r\n\r\n----------------------------------------------------------------------------\r\nThe Rekall Digital Forensic/Incident Response framework 1.7.2.rc1 (Hurricane Ridge).\r\n\r\n\"We can remember it for you wholesale!\"\r\n\r\nThis program is free software; you can redistribute it and/or modify it under\r\nthe terms of the GNU General Public License.\r\n\r\nSee http://www.rekall-forensic.com/docs/Manual/tutorial.html to get started.\r\n----------------------------------------------------------------------------\r\n[1] fullmem.mem 22:19:51> ifconfig\r\n2018-11-13 22:20:29,051:ERROR:rekall.1:No profiles match this image. Try specifying manually.\r\n---------------------------------------------------------------------------\r\nRuntimeError                              Traceback (most recent call last)\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/IPython/core/prefilter.pyc in prefilter_lines(self, lines, continue_prompt)\r\n    333                              for lnum, line in enumerate(llines) ])\r\n    334         else:\r\n--> 335             out = self.prefilter_line(llines[0], continue_prompt)\r\n    336 \r\n    337         return out\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/IPython/core/prefilter.pyc in prefilter_line(self, line, continue_prompt)\r\n    308             return normal_handler.handle(line_info)\r\n    309 \r\n--> 310         prefiltered = self.prefilter_line_info(line_info)\r\n    311         # print \"prefiltered line: %r\" % prefiltered\r\n    312         return prefiltered\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/IPython/core/prefilter.pyc in prefilter_line_info(self, line_info)\r\n    250         \"\"\"\r\n    251         # print \"prefilter_line_info: \", line_info\r\n--> 252         handler = self.find_handler(line_info)\r\n    253         return handler.handle(line_info)\r\n    254 \r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/IPython/core/prefilter.pyc in find_handler(self, line_info)\r\n    257         for checker in self.checkers:\r\n    258             if checker.enabled:\r\n--> 259                 handler = checker.check(line_info)\r\n    260                 if handler:\r\n    261                     return handler\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/IPython/core/prefilter.pyc in check(self, line_info)\r\n    413 \r\n    414     def check(self, line_info):\r\n--> 415         obj = self.shell.user_ns.get(line_info.ifun)\r\n    416         if isinstance(obj, Macro):\r\n    417             return self.prefilter_manager.get_handler_by_name('macro')\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in get(self, item, default)\r\n   1183     def get(self, item, default=None):\r\n   1184         try:\r\n-> 1185             return self[item]\r\n   1186         except KeyError:\r\n   1187             return default\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in __getitem__(self, item)\r\n   1176             return super(DynamicNameSpace, self).__getitem__(item)\r\n   1177         except KeyError:\r\n-> 1178             if getattr(self[\"session\"].plugins, item):\r\n   1179                 return self._prepare_runner(item)\r\n   1180 \r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in __getattr__(self, name)\r\n    153         pslist_plugin = plugins.pslist()\r\n    154         \"\"\"\r\n--> 155         plugin_cls = self.GetPluginClass(name)\r\n    156         if plugin_cls == None:\r\n    157             return plugin_cls\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in GetPluginClass(self, name)\r\n    133         \"\"\"\r\n    134         # Try to see if the requested plugin is active right now.\r\n--> 135         metadata = self.plugin_db.GetActivePlugin(name)\r\n    136         if metadata == None:\r\n    137             return metadata\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/plugin.pyc in GetActivePlugin(self, plugin_name)\r\n    980         for command_metadata in self.db.get(plugin_name, []):\r\n    981             plugin_cls = command_metadata.plugin_cls\r\n--> 982             if plugin_cls.is_active(self.session):\r\n    983                 results.append(command_metadata)\r\n    984 \r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/plugin.pyc in is_active(cls, session)\r\n    432             # completing the available plugins we will trigger profile\r\n    433             # autodetection in order to determine which plugins are active.\r\n--> 434             profile = (session.profile != None and\r\n    435                        super(ProfileCommand, cls).is_active(session))\r\n    436 \r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall_lib/utils.pyc in __get__(self, *args, **kwargs)\r\n   1089     def __get__(self, *args, **kwargs):\r\n   1090         try:\r\n-> 1091             return super(safe_property, self).__get__(*args, **kwargs)\r\n   1092         except AttributeError as e:\r\n   1093             message = \"AttributeError raised: %s\" % e\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in profile(self)\r\n   1060             return process_context\r\n   1061 \r\n-> 1062         res = self.GetParameter(\"profile_obj\")\r\n   1063         return res\r\n   1064 \r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in GetParameter(self, item, default, cached)\r\n    766         # can get if from a hook.\r\n    767         try:\r\n--> 768             result = self._RunParameterHook(item)\r\n    769             if result is not None:\r\n    770                 return result\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/session.pyc in _RunParameterHook(self, name)\r\n    801                     self._hook_locks.add(name)\r\n    802                     hook = cls(session=self)\r\n--> 803                     result = hook.calculate()\r\n    804 \r\n    805                     # Cache the output from the hook directly.\r\n\r\n/root/.pyenv/versions/2.7.11/lib/python2.7/site-packages/rekall/plugins/guess_profile.pyc in calculate(self)\r\n    762             if not profile_obj:\r\n    763                 raise RuntimeError(\r\n--> 764                     \"Unable to find a valid profile for this image. \"\r\n    765                     \"Try using -v for more details.\")\r\n    766 \r\n\r\nRuntimeError: Unable to find a valid profile for this image. Try using -v for more details.\r\n\r\nBTW, my rekall runs successfully with pslist command for a Windows Memory dump file, so I think my rekall has been correctly installed.\r\n"}}
{"actor":{"display_login":"YourDaddyIsHere"}}