RISC-V support

Open neiling opened this issue 3 years ago • 1 comments

Hey guys,

is there already support for RISC-V images? I tried to analyze a Debian RISC-V image, but I get e.g. with the plugin pslist only an empty list which I would not expect. The debug output compared to a Debian AMD64 image looks almost the same.

Thanks a lot

Jun 09 '22 14:06 neiling

I'm afraid we don't yet support any architectures other than intel (32-bit, pae and 64-bit). We're investigating arm support, but that hasn't gotten very far unfortunately. The main support would be the need for a mapping layer which supports the RISC-V architecture's memory mapping model. I haven't ever investigated that specific architecture, but even implementing a layer there'd still be some details to resolve around supporting multiple architectures. If volatility 3 currently detects an intel layer in the debug output, then there'll definitely be some work needed to make sure the architecture is properly detected.

I hope that helps? We're always happy to get sample if you have a test system for the architecture? Otherwise there isn't a timeline for new architectures I'm afraid, it's just as and when they get implemented. I hope that helps?

Jun 09 '22 21:06 ikelos