yum install -y gcc make gcc-c++
yum install -y elfutils-devel
yum install -y kernel-devel
wget https://www.prevanders.net/libdwarf-20201201.tar.gz
tar -zxvf libdwarf-20201201.tar.gz
cd libdwarf-20201201
./configure
make
make install
cd ../
在 volatility 目录中的 tool/Linux 运行 make 命令来创建 module.dwarf 文件
git clone https://github.com/volatilityfoundation/volatility.git
cd volatility/tools/linux
make
ls -l
banners.Banners Attempts to identify potential linux banners in an image
configwriter.ConfigWriter Runs the automagics and both prints and outputs configuration in the output directory.
frameworkinfo.FrameworkInfo Plugin to list the various modular components of Volatility
isfinfo.IsfInfo Determines information about the currently available ISF files, or a specific one
layerwriter.LayerWriter Runs the automagics and writes out the primary layer produced by the stacker.
linux.bash.Bash Recovers bash command history from memory.
linux.check_afinfo.Check_afinfo Verifies the operation function pointers of network protocols.
linux.check_creds.Check_creds Checks if any processes are sharing credential structures
linux.check_idt.Check_idt Checks if the IDT has been altered
linux.check_modules.Check_modules Compares module list to sysfs info, if available
linux.check_syscall.Check_syscall Check system call table for hooks.
linux.elfs.Elfs Lists all memory mapped ELF files for all processes.
linux.keyboard_notifiers.Keyboard_notifiers Parses the keyboard notifier call chain
linux.lsmod.Lsmod Lists loaded kernel modules.
linux.lsof.Lsof Lists all memory maps for all processes.
linux.malfind.Malfind Lists process memory ranges that potentially contain injected code.
linux.proc.Maps Lists all memory maps for all processes.
linux.pslist.PsList Lists the processes present in a particular linux memory image.
linux.pstree.PsTree Plugin for listing processes in a tree based on their parent process ID.
linux.tty_check.tty_check Checks tty devices for hooks
mac.bash.Bash Recovers bash command history from memory.
mac.check_syscall.Check_syscall Check system call table for hooks.
mac.check_sysctl.Check_sysctl Check sysctl handlers for hooks.
mac.check_trap_table.Check_trap_table Check mach trap table for hooks.
mac.ifconfig.Ifconfig Lists loaded kernel modules
mac.kauth_listeners.Kauth_listeners Lists kauth listeners and their status
mac.kauth_scopes.Kauth_scopes Lists kauth scopes and their status
mac.kevents.Kevents Lists event handlers registered by processes
mac.list_files.List_Files Lists all open file descriptors for all processes.
mac.lsmod.Lsmod Lists loaded kernel modules.
mac.lsof.Lsof Lists all open file descriptors for all processes.
mac.malfind.Malfind Lists process memory ranges that potentially contain injected code.
mac.mount.Mount A module containing a collection of plugins that produce data typically foundin Mac's mount command
mac.netstat.Netstat Lists all network connections for all processes.
mac.proc_maps.Maps Lists process memory ranges that potentially contain injected code.
mac.psaux.Psaux Recovers program command line arguments.
mac.pslist.PsList Lists the processes present in a particular mac memory image.
mac.pstree.PsTree Plugin for listing processes in a tree based on their parent process ID.
mac.socket_filters.Socket_filters Enumerates kernel socket filters.
mac.timers.Timers Check for malicious kernel timers.
mac.trustedbsd.Trustedbsd Checks for malicious trustedbsd modules
mac.vfsevents.VFSevents Lists processes that are filtering file system events
timeliner.Timeliner Runs all relevant plugins that provide time related information and orders the results by time.
windows.bigpools.BigPools List big page pools.
windows.cachedump.Cachedump Dumps lsa secrets from memory
windows.callbacks.Callbacks Lists kernel callbacks and notification routines.
windows.cmdline.CmdLine Lists process command line arguments.
windows.dlllist.DllList Lists the loaded modules in a particular windows memory image.
windows.driverirp.DriverIrp List IRPs for drivers in a particular windows memory image.
windows.driverscan.DriverScan Scans for drivers present in a particular windows memory image.
windows.dumpfiles.DumpFiles Dumps cached file contents from Windows memory samples.
windows.envars.Envars Display process environment variables
windows.filescan.FileScan Scans for file objects present in a particular windows memory image.
windows.getservicesids.GetServiceSIDs Lists process token sids.
windows.getsids.GetSIDs Print the SIDs owning each process
windows.handles.Handles Lists process open handles.
windows.hashdump.Hashdump Dumps user hashes from memory
windows.info.Info Show OS & kernel details of the memory sample being analyzed.
windows.lsadump.Lsadump Dumps lsa secrets from memory
windows.malfind.Malfind Lists process memory ranges that potentially contain injected code.
windows.memmap.Memmap Prints the memory map
windows.modscan.ModScan Scans for modules present in a particular windows memory image.
windows.modules.Modules Lists the loaded kernel modules.
windows.mutantscan.MutantScan Scans for mutexes present in a particular windows memory image.
windows.netscan.NetScan Scans for network objects present in a particular windows memory image.
windows.netstat.NetStat Traverses network tracking structures present in a particular windows memory image.
windows.poolscanner.PoolScanner A generic pool scanner plugin.
windows.privileges.Privs Lists process token privileges
windows.pslist.PsList Lists the processes present in a particular windows memory image.
windows.psscan.PsScan Scans for processes present in a particular windows memory image.
windows.pstree.PsTree Plugin for listing processes in a tree based on their parent process ID.
windows.registry.certificates.Certificates Lists the certificates in the registry's Certificate Store.
windows.registry.hivelist.HiveList Lists the registry hives present in a particular memory image.
windows.registry.hivescan.HiveScan Scans for registry hives present in a particular windows memory image.
windows.registry.printkey.PrintKey Lists the registry keys under a hive or specific key value.
windows.registry.userassist.UserAssist Print userassist registry keys and information.
windows.ssdt.SSDT Lists the system call table.
windows.statistics.Statistics
windows.strings.Strings Reads output from the strings command and indicates which process(es) each string belongs to.
windows.svcscan.SvcScan Scans for windows services.
windows.symlinkscan.SymlinkScan Scans for links present in a particular windows memory image.
windows.vadinfo.VadInfo Lists process memory ranges.
windows.vadyarascan.VadYaraScan Scans all the Virtual Address Descriptor memory maps using yara.
windows.verinfo.VerInfo Lists version information from PE files.
windows.virtmap.VirtMap Lists virtual mapped sections.
yarascan.YaraScan Scans kernel memory using yara rules (string or file).
符号表 JSON 文件默认位于 volatility/symbols 下，在操作系统目录下（目前是 windows、mac 或 linux 中的一种）。符号目录是可以在框架内配置的，通常可以在用户界面上设置。
这些文件也可以被压缩成 ZIP 文件，Volatility 将处理 ZIP 文件以定位符号文件。ZIP 文件必须以相应的操作系统命名（如 linux.zip、mac.zip 或 windows.zip）。在 ZIP 文件中，目录结构应与未压缩的操作系统目录一致。
Windows 符号表
对于 Windows 系统，Volatility 接受由 GUID 和所需 PDB 文件的 Age 组成的字符串。然后，它在 Windows 子目录下的已配置符号目录下搜索所有文件。与文件名模式 /-.json（或任何压缩变体）匹配的任何文件都会被使用。如果找不到这样的符号表，则将从 Microsoft 的 Symbol Server 下载关联的 PDB 文件，并将其转换为适当的 JSON 格式，并将其保存在正确的位置。
Windows 符号表可以从适当的 PDB 文件手动构建。用于执行此操作的主要工具内置于 Volatility 3 中，称为 pdbconv.py。
Mac / Linux 符号表
对于 Mac / Linux 系统，两者都使用相同的识别机制。JSON 文件位于符号目录下的 linux 或 mac 目录下。生成的文件包含一个标识字符串（操作系统横幅），Volatility 的 automagic 可以检测到该字符串。易失性会缓存字符串和它们来自的符号表之间的映射，这意味着精确的文件名无关紧要，并且可以在操作系统目录下的任何必要层次结构下进行组织。
可以使用称为 dwarf2json 的工具从 DWARF 文件生成 Linux 和 Mac 符号表。当前，带有调试符号的内核是恢复大多数 Volatility 插件所需的所有信息的唯一合适方法。找到具有调试符号 / 适当的 DWARF 文件的内核之后，dwarf2json 会将其转换为适当的 JSON 文件。
相关工具
MacOS Processing
./dwarf2json mac --macho /path/kernel.dSYM/Contents/Resources/DWARF/kernel \
--macho-symbols /path/kernel > output.json
Linux Processing
./dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-4.4.0-137-generic > output.json