Install Volatility on Kali Linux (including M1 Mac CPU)

That is the single instruction how to install Volatility application on Kali Linux (including M1 Mac CPU).

INSTALLATION

#!/bin/bash
sudo apt-get update
sudo apt install -y python2.7
sudo apt install -y python-pip python-setuptools build-essential python2.7-dev
python -m pip install distorm3==3.4.4
python -m pip install pycrypto
git clone https://github.com/volatilityfoundation/volatility.git
chmod +x volatility/vol.py
sudo mv volatility /opt
sudo ln -s /opt/volatility/vol.py /usr/bin/vol.py
sudo ln -s /opt/volatility/vol.py /usr/bin/volatility
vol.py –info

ADD PROFILES

git clone https://github.com/volatilityfoundation/profiles.git

cp -r PROFILE.ZIP /opt/volatility/volatility/plugins/overlays/linux

CREATE LINUX PROFILE

sudo apt-get install dwarfdump
cd /opt/volatility/tools/linux/
make #module.dwarf is created
zip file.zip /opt/volatility/tools/linux/module.dwarf /boot/System.map-3.11.0-17-generic

zip $(lsb_release -i -s)_$(uname -r)_profile.zip /opt/volatility/tools/linux/module.dwarf /boot/System.map-$(uname -r)

DUMP LINUX MEMORY

git clone https://github.com/504ensicsLabs/LiME.git

cd LiME/src/

make #build

insmod ./lime*ko “path=/tmp/dump.mem format=lime”

ls -l /tmp/dump.mem # memory dump

rmmod lime

Ivan Glinkin