volatility error: no suitable address space mapping.

[Big Strong]

I've seen similar posts about this issue "volatility error: no suitable address space mapping." 

however, none of them solved my problem.

I generated the profile with this guide https://github.com/volatilityfoundation/volatility/wiki/Linux#creating-a-new-profile

And also tested with the profile at https://github.com/volatilityfoundation/profiles/blob/master/Linux/Ubuntu/x64/Ubuntu1404.zip 

I've also tried recompile libvmi.

All failed as (if you need any more information, please feel free to ask):

sudo python vol.py -l vmi://ubuntu-hvm --profile=Linuxubuntu1404x64 linux_netstat

Volatility Foundation Volatility Framework 2.4
No suitable address space mapping found
Tried to open image as:
 MachOAddressSpace: mac: need base
 LimeAddressSpace: lime: need base
 WindowsHiberFileSpace32: No base Address Space
 WindowsCrashDumpSpace64BitMap: No base Address Space
 WindowsCrashDumpSpace64: No base Address Space
 HPAKAddressSpace: No base Address Space
 VirtualBoxCoreDumpElf64: No base Address Space
 VMWareMetaAddressSpace: No base Address Space
 VMWareAddressSpace: No base Address Space
 QemuCoreDumpElf: No base Address Space
 WindowsCrashDumpSpace32: No base Address Space
 AMD64PagedMemory: No base Address Space
 IA32PagedMemoryPae: No base Address Space
 IA32PagedMemory: No base Address Space
 MachOAddressSpace: MachO Header signature invalid
 LimeAddressSpace: Invalid Lime header signature
 WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
 WindowsCrashDumpSpace64BitMap: Header signature invalid
 WindowsCrashDumpSpace64: Header signature invalid
 HPAKAddressSpace: Location is not of file scheme
 VirtualBoxCoreDumpElf64: ELF Header signature invalid
 VMWareMetaAddressSpace: Location is not of file scheme
 VMWareAddressSpace: Invalid VMware signature: -
 QemuCoreDumpElf: ELF Header signature invalid
 WindowsCrashDumpSpace32: Header signature invalid
 AMD64PagedMemory: Failed valid Address Space check
 IA32PagedMemoryPae: Incompatible profile Linuxubuntu1404x64 selected
 IA32PagedMemory: Incompatible profile Linuxubuntu1404x64 selected
 PyVmiAddressSpace: Must be first Address Space
 OSXPmemELF: ELF Header signature invalid
 FileAddressSpace: Must be first Address Space
 ArmAddressSpace: Failed valid Address Space check

[Big Strong]

Forget to mention that the pyvmi works ok with windows guests. Both the windows and ubuntu guest are hvm virtual machines based on xen.

So I believe it should be the problem of the linux profile. Is there any way to verify the correctness of the profile?

在 2016年12月22日星期四 UTC+8上午11:51:59，Big Strong写道：

[Maju R]

Hi,

Volatility 2.4 supports 32- and 64-bit Linux kernels up to 3.16. Check your ubuntu kernel version, maybe upgrading to Volatility 2.5 will help.

[Big Strong]

Thanks very much! My kernel is 3.19 and that's exactly the problem.

在 2016年12月26日星期一 UTC+8上午4:58:07，Maju R写道：