"ArmAddressSpace - EXCEPTION: 'state'"

[RubaAlsmadi]

Hi,

I'm trying to dump an Arch Linux memory using Volatility 2, and I got the following error :
Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:

A translation layer requirement was not fulfilled. Please verify that:
A file was provided to create this layer (by -f, --single-location or by config)
The file exists and is readable
The file is a valid memory image and was acquired cleanly

A symbol table requirement was not fulfilled. Please verify that:
The associated translation layer requirement was fulfilled
You have the correct symbol file for the requirement
The symbol file is under the correct directory or zip file
The symbol file is named appropriately or contains the correct banner

Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']

I started solving this by running this command dwarf2json linux --elf [path to debug kernel] > [kernel name].json

I found the VMLinux system map in the Arch Linux device but could not find the debug kernel. I started creating a new profile for Arch Linux, and I was able to create a new profile, and I can see the profile. However, when I try to use the profile, it fails with an error.

In the KBUILD_CLFAGS I made these changes.

ifdef CONFIG_DEBUG_INFO DEBUG_CFLAGS += -gsplit-dwarf -gdwarf-4 endif

The initial error has gone away, but the modules haven't run successfully.
`
WARNING : volatility.debug : Overlay structure cpuinfo_x86 not present in vtypes
Offset Name Pid PPid Uid Gid DTB Start Time

---

No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
VMWareMetaAddressSpace: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareAddressSpace: No base Address Space
QemuCoreDumpElf: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
WindowsCrashDumpSpace64BitMap: Header signature invalid
VMWareMetaAddressSpace: VMware metadata file is not available
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: -
QemuCoreDumpElf: ELF Header signature invalid
WindowsCrashDumpSpace32: Header signature invalid
SkipDuplicatesAMD64PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected
WindowsAMD64PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected
LinuxAMD64PagedMemory - EXCEPTION: 'state'
AMD64PagedMemory - EXCEPTION: 'state'
IA32PagedMemoryPae: Incompatible profile Linuxubuntu22_04x64 selected
IA32PagedMemory: Incompatible profile Linuxubuntu22_04x64 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace - EXCEPTION: 'state'
To solve the state exception, I used this state_offset = profile.get_obj_offset("task_struct", "state")

    try:
        # For Linux kernels < v5.14-rc1
        state_offset  = profile.get_obj_offset("task_struct", "state")
    except:
        # For Linux kernels >= v5.14-rc1, based on commit 2f064a59a11ff9bc22e52e9678bc601404c7cb34
        state_offset  = profile.get_obj_offset("task_struct", "__state")

`

but in this case I stop seeing the profiles that I created.

``