volatility-plugins icon indicating copy to clipboard operation
volatility-plugins copied to clipboard

Can chromecookies support Chrome 83?

Open thangld322 opened this issue 5 years ago • 0 comments

Hi, I'm using this plugin on Ubuntu 18.04.4 LTS to get cookies of Chrome 83 but it does not print out anything while chromehistory works just fine. Steps: I create the memory image follows this guide.

insmod lime-5.3.0-53-generic.ko "path=/home/anhtm/linux64.mem format=lime"
zip volatility/plugins/overlays/linux/Ubuntu_5.3.0-51-generic_profile.zip tools/linux/module.dwarf /boot/System.map-5.3.0-51-generic
python vol.py -f /home/anhtm/linux64.mem --profile=LinuxUbuntu_5_3_0-51-generic_profilex64 chromecookies

Results:

No suitable address space mapping found
Tried to open image as:
 MachOAddressSpace: mac: need base
 LimeAddressSpace: lime: need base
 WindowsHiberFileSpace32: No base Address Space
 VMotionMigrationAddressSpace: VMotionMigration requires a base
 EWFAddressSpace: No libEWF implementation found
 WindowsCrashDumpSpace64BitMap: No base Address Space
 HPAKAddressSpace: No base Address Space
 VMWareAddressSpace: No base Address Space
 QemuCoreDumpElf: No base Address Space
 WindowsCrashDumpSpace32: No base Address Space
 WindowsCrashDumpSpace64: No base Address Space
 VMWareMetaAddressSpace: No base Address Space
 VirtualBoxCoreDumpElf64: No base Address Space
 SkipDuplicatesAMD64PagedMemory: No base Address Space
 WindowsAMD64PagedMemory: No base Address Space
 LinuxAMD64PagedMemory: No base Address Space
 AMD64PagedMemory: No base Address Space
 IA32PagedMemoryPae: No base Address Space
 IA32PagedMemory: No base Address Space
 OSXPmemELF: No base Address Space
 MachOAddressSpace: MachO Header signature invalid
 MachOAddressSpace: MachO Header signature invalid
 LimeAddressSpace: Invalid Lime header signature
 WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
 VMotionMigrationAddressSpace: VMotion migration magic not found
 EWFAddressSpace: No libEWF implementation found
 WindowsCrashDumpSpace64BitMap: Header signature invalid
 HPAKAddressSpace: Invalid magic found
 VMWareAddressSpace: Invalid VMware signature: 0x0
 QemuCoreDumpElf: ELF Header signature invalid
 WindowsCrashDumpSpace32: Header signature invalid
 WindowsCrashDumpSpace64: Header signature invalid
 VMWareMetaAddressSpace: VMware metadata file is not available
 VirtualBoxCoreDumpElf64: ELF Header signature invalid
 SkipDuplicatesAMD64PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
 WindowsAMD64PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
 LinuxAMD64PagedMemory: Failed valid Address Space check
 AMD64PagedMemory: Failed valid Address Space check
 IA32PagedMemoryPae: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
 IA32PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
 OSXPmemELF: ELF Header signature invalid
 FileAddressSpace: Must be first Address Space
 ArmAddressSpace: Failed valid Address Space check

I need to get chrome cookies using this tool. Please help.

thangld322 avatar May 31 '20 08:05 thangld322