create-profile.sh

#!/bin/bash
# Simple script to create a makefile for a Volatility profile.
# Intended to be used with an image file.
# As developed for PentesterAcademy
# by Dr. Phil Polstra (@ppolstra)

usage() {
  echo "Script to create a Volatility profile from a mounted image file"
  echo "Usage: $0 <path to image root>"
  exit 1
}

if [ $# -lt 1 ] ; then
    usage
fi

oldir=$(pwd)
cd ${1}/boot
ver=$(ls System.map* | sed "s/System.map-//" | tr "\n" "|" \
  | sed -nr 's/([a-zA-Z0-9\.\-]+\|)*([a-zA-Z0-9\.\-]+\|)$/\2/p' \
  | sed "s/|/\n/")
cd "${oldir}"

echo "Version: ${ver}"


PWD=$(pwd)
MAKE=$(which make)

cat <<EOF > Makefile.${ver}
obj-m += module.o

-include version.mk

all: dwarf

dwarf: module.c
    ${MAKE} -C ${1}/lib/modules/${ver}/build CONFIG_DEBUG_INFO=y M="${PWD}" modules
    dwarfdump -di module.ko > module.dwarf
    ${MAKE} -C ${1}/lib/modules/${ver}/build M="${PWD}" clean

clean:
    ${MAKE} -C ${1}/lib/modules/${ver}/build M="${PWD}" clean
    rm -f module.dwarf
EOF

# make the dwarf file
make -f Makefile.${ver}
# copy the System.map file
cp ${1}/boot/System.map-${ver} ./.
# now make the zip
zip Linux${ver}.zip module.dwarf System.map-{ver}