Centos6.6 system profile method

Centos6.6 system profile method

Volatiltiy is used for memory analysis during this period. Because I am working on Centos, I need to make a CentOs profile, the volatility official website and other forums have not been directly resolved. Finally, I tried the methods through various methods.

1. Install the dwarfdump tool first. Generally, this is not in the CentOs source, so you need to download it yourself.

First install:

Yum install elfutils-devel

Then obtain the dwarfdump source file:

Wget 'HTTP: // www.prevandres.net/libdwarf-20140413.tar.gz'

Decompress the package and enter the folder.

./Configure

Make

Go to the dwarfdump folder.

Make install

Since then, dwarfdump has been installed.

2.g ++ may not be installed in CentOs

To install g ++, follow these steps:

Yum install gcc-c ++

3. Find the linux folder under the tools Folder under the volatility folder,

In the volatiltiy/volatility/tools/linux/directory:

Make

A file in the dwarfdump format, moudle. dwarfdump, is generated.

4. Package systemmap in the boot folder and moudle. dwarf generated in step 3 to generate a profile.

Zip CentOs6.6.zip module. dwarfdump/boot/Systemmap -....

Systemmap varies with the kernel.