Error generating Rekall/Volatility profile

[SaiHarshaK]

Hello, I am following the setup guide for LibVMI Rekall/Volatility profile, but I am getting the following error:

$ sudo ../../libvmi/build/examples/vmi-win-guid name ub20srv
Failed to init LibVMI library

Here, ub20srv is a ubuntu 20 server VM which I can configured according to the steps shown here.

Any suggestions on how I could resolve this?

[tklengyel]

You don't need to run win-guid on an Ubuntu VM.

[tklengyel]

You want to use dwarf2json to generate Linux jsons: https://github.com/volatilityfoundation/dwarf2json

[SaiHarshaK]

I tried to do that but i was getting the following error:

$ sudo ./dwarf2json linux --elf /boot/vmlinuz-4.15.0-136-generic > output.json
Failed linux processing: could not open /boot/vmlinuz-4.15.0-136-generic: bad magic number '[77 90 234 7]' in record at byte 0x0

Do I need to download any specific version of vmlinuz?

Also, I wasn't sure where I could ask this but I'm curious if VMI works only for x86 VMs or cross-machine emulations too?

[tklengyel]

Yes, you need the kernel version with the dwarf debug symbols present. The normal kernel versions have those stripped.