I have a Linux memory dump which I need to analyze in order to discover a suspicious PID, however I don't have a profile or anything outside the dump file and using
volatility imageinfo doesn't work.
How can I analyze it?
After an hour or so of volatility imageinfo I got this result:
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : No suggestion (Instantiated with no profile)
AS Layer1 : LimeAddressSpace (Unnamed AS)
AS Layer2 : FileAddressSpace (dump)
PAE type : No PAE
What can I do now to know the profile that I need to work with?