Repository navigation
[BUG] linux.pslist.PsList - Android 15 LiME dump not recognized #1892
Description
Unable to access the linux.pslist.PsList plugin from an Android 15 (Pixel 7 emulator) LiME dump.
Volatility 3 fails to satisfy requirements plugins.PsList.kernel.layer_name and plugins.PsList.kernel.symbol_table_name, despite a matching symbol file existing in the Linux symbols path.
Command executed
python3 vol.py -vvv -f ~/Desktop/ram.raw -s ~/.cache/volatility3/symbols/linux/ linux.pslist.PsList
Context
Volatility Version: 3 Framework 2.27.0
OS (Host): Ubuntu 24.04.3 LTS
Python Version: 3.12.3 (GCC 13.3.0)
Suspected Target OS: Android 15 (kernel 6.6.30-android15-8-maybe-dirty) — Pixel 7 emulator image
Acquisition Tool: LiME (compiled and loaded in Android Emulator)
Command:
python3 vol.py -vvv -f ~/Desktop/ram.raw -s ~/.cache/volatility3/symbols/linux/ linux.pslist.PsList
Relevant output
Unsatisfied requirement plugins.PsList.kernel.layer_name:
Unsatisfied requirement plugins.PsList.kernel.symbol_table_name:
A translation layer requirement was not fulfilled.
A symbol table requirement was not fulfilled.
DEBUG volatility3.framework.automagic.linux: No suitable linux banner could be matched
DEBUG volatility3.framework.automagic.symbol_cache: Duplicate entry for identifier '6.6.30-android15-8-maybe-dirty'
Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name']
Expected behavior
Volatility should load the correct Linux symbols (6.6.30-android15-8-maybe-dirty.json) and output the process list.
Additional information
Symbol file exists at:
~/.cache/volatility3/symbols/linux/6.6.30-android15-8-maybe-dirty.json
Kernel banner detected correctly:
Linux version 6.6.30-android15-8-maybe-dirty (kleaf@build-host)
Possibly related to:
Android kernels compiled with Clang 18 (AOSP r510928)
Emulator memory layout (non-standard LiME offsets?)
Question
Is additional configuration or custom symbol generation required for Android 15 (Clang-based) kernels to make linux.pslist.PsList work properly in Volatility 3?
Activity
[-]6.6.30-android15-8-maybe-dirty - Android 15 - Pixel 7 Emulator Android Studio - Vol3 + LiME error.[/-][+][BUG] linux.pslist.PsList - Android 15 LiME dump not recognized[/+]eve-mem commentedon Oct 27, 2025
Hello, I'm assuming it also emulates arm too? If so vol doesn't currently support it, however you can try this PR which adds in some arm support.
#1088
eve-mem commentedon Oct 27, 2025
Ah ok. Great. Could you please share the full log with the pslist output -vvvv option. It'll help diagnose the problem.
Could you also share the output of the banners plugin and the isfinfo plugin.
Thanks 😊
eve-mem commentedon Oct 29, 2025
Thanks for that information, it looks like the isfinfo output was cut off? The logs show that a banner was identified in the sample, so it's likely you've generated them correctly.
Reading the verbose logs, it looks like the lime file wasn't detected as an elf. When you created the dump did you use the raw method? If so unfortunately that doesn't preserve the layout of memory correctly and so can't be parsed. (Some attempt to make that more obvious here jtsylve/LiME#121)
eve-mem commentedon Nov 1, 2025
What command did you run with lime when you created the memory dump?
If it is a virtual machine, you can likely have some hypervisor command to dump the memory out as well. That means you don't have to use lime.
I doubt you will need to rewrite vol to make it parse a memory dump of this machine.
eve-mem commentedon Nov 10, 2025
If you can share some samples that would help considerably. Can you tell me what command you used exactly to make the memory dump?
ikelos commentedon Nov 19, 2025
You've said the command line for running lime was using
--format=limebut volatility didn't detect the output file as a lime file (as indicated byDEBUG volatility3.framework.automagic.stacker: Stacked layers: ['FileLayer']which does not list lime amongst the stacked layers. The lime "raw" format will not work with volatility, and the lime format itself is very simple and should be detected easily by volatility. Since the debug line suggests it hasn't been, you should verify that your installation of volatility is accurate, and then look for lines in the debug output (using-vvvvvvv) to see what happens when it tries to detect the lime format.ikelos commentedon Nov 19, 2025
The new output you've provided does now identify it as a lime layer.
The new problem appears to be a missing symbol that's expected to be in the symbol table:
It seems this is a known issue, please see bug #1761.