Easy way to find the Intermediate Symbol File (ISF) for the Linux memory image

You don’t need to create a new ISF file for every Linux memory image. Sometimes you can just use the symbol tables which are already been created by the other users. Here is the step-by-step guide on how to do it better and faster. We gonna utilize the --remote-isf-url option in Volatility3 or shorten -u option.

Guide

1. Go to Github and copy one of the links to the banners. Personally, I use https://raw.githubusercontent.com/Abyss-W4tcher/volatility3-symbols/refs/heads/master/banners/banners.json or https://raw.githubusercontent.com/leludo84/vol3-linux-profiles/refs/heads/main/banners-isf.json

2. Now, everything is ready. You can use the --remote-isf-url option or shorten -u option.

python3 vol.py -f ~/uac/memory_dump/avml.lime -u https://raw.githubusercontent.com/Abyss-W4tcher/volatility3-symbols/refs/heads/master/banners/banners.json linux.pslist

Important tips

• However, sometimes you will be needed to create a ISF file for your Linux memory image anyway.
• Also, check this project which combines multiple ISF files from several github repositories: https://github.com/calilkhalil/basar