[Vol-users] stack & heap

Andrew Case atcuno at gmail.com
Mon Sep 30 20:03:06 CDT 2013


Can you please send the full command line input and output related to
your issue?

Also:
-  the kernel/distro that the sample was taken from
- what acquisition tool was used
- what version of Volatility you are using.

This will greatly help us diagnose the issue.

Thanks,
Andrew (@attrc)

On Thu, Sep 26, 2013 at 4:05 PM, Sebastian Biedermann
<biedermann at seceng.informatik.tu-darmstadt.de> wrote:
> Hi guys,
>
> I'm trying to find out the addresses of the memory pages of a target process
> that are used as stack and heap on Linux.
> (Precisely, I would like to have the output which can be seen in
> /proc/<pid>/maps for a target process)
>
> Unfortunately, the command linux_proc_maps is not working, I always get a
> segmentation fault,
> although I tried different kernels as well as Linux setups (Ubuntu) - it's
> just not working.
>
> Can anyone tell me a setup (Linux & Kernel) in which the linux_proc_maps
> command works?
> Or give me a hint how I could figure out these addresses on another way?
>
> Thank you!
> _______________________________________________
> Vol-users mailing list
> Vol-users at volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users


More information about the Vol-users mailing list