volatility-plugins
volatility-plugins copied to clipboard
Can chromecookies support Chrome 83?
Hi, I'm using this plugin on Ubuntu 18.04.4 LTS to get cookies of Chrome 83 but it does not print out anything while chromehistory works just fine. Steps: I create the memory image follows this guide.
insmod lime-5.3.0-53-generic.ko "path=/home/anhtm/linux64.mem format=lime"
zip volatility/plugins/overlays/linux/Ubuntu_5.3.0-51-generic_profile.zip tools/linux/module.dwarf /boot/System.map-5.3.0-51-generic
python vol.py -f /home/anhtm/linux64.mem --profile=LinuxUbuntu_5_3_0-51-generic_profilex64 chromecookies
Results:
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
VMotionMigrationAddressSpace: VMotionMigration requires a base
EWFAddressSpace: No libEWF implementation found
WindowsCrashDumpSpace64BitMap: No base Address Space
HPAKAddressSpace: No base Address Space
VMWareAddressSpace: No base Address Space
QemuCoreDumpElf: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
VMWareMetaAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile
VMotionMigrationAddressSpace: VMotion migration magic not found
EWFAddressSpace: No libEWF implementation found
WindowsCrashDumpSpace64BitMap: Header signature invalid
HPAKAddressSpace: Invalid magic found
VMWareAddressSpace: Invalid VMware signature: 0x0
QemuCoreDumpElf: ELF Header signature invalid
WindowsCrashDumpSpace32: Header signature invalid
WindowsCrashDumpSpace64: Header signature invalid
VMWareMetaAddressSpace: VMware metadata file is not available
VirtualBoxCoreDumpElf64: ELF Header signature invalid
SkipDuplicatesAMD64PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
WindowsAMD64PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
LinuxAMD64PagedMemory: Failed valid Address Space check
AMD64PagedMemory: Failed valid Address Space check
IA32PagedMemoryPae: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
IA32PagedMemory: Incompatible profile LinuxUbuntu_5_3_0-51-generic_profilex64 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Failed valid Address Space check
I need to get chrome cookies using this tool. Please help.