From 0f33734f3bd541118d5c51491bb856c7ed91c880 Mon Sep 17 00:00:00 2001 From: Jaeyou PARK Date: Mon, 23 Jun 2025 15:20:42 +0900 Subject: [PATCH] Update getting-started-linux-tutorial.rst : Add reference to Abyss-W4tcher/volatility3-symbols Recommend users first check this repository for pre-generated symbol tables by kernel version for popular Linux distributions before creating their own. --- doc/source/getting-started-linux-tutorial.rst | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index bb40de208..d84872b3e 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -12,14 +12,19 @@ Volatility3 does not provide the ability to acquire memory. Below is an example Other tools may exist, but please verify their maintenance status and compatibility with volatility3 before use. -Procedure to create symbol tables for linux +Procedure to create symbol tables for Linux ------------------------------------------- -To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. +It is recommended to first check the repository `volatility3-symbols `_ for pre-generated JSON.xz symbol table files. +This repository provides files organized by kernel version for popular Linux distributions such as Debian, Ubuntu, and AlmaLinux. + +If you cannot find a suitable symbol table for your kernel version there, please refer to :ref:`symbol-tables:Mac or Linux symbol tables` to create one manually. + After creating the file, place it under the directory ``volatility3/symbols``. Volatility3 will automatically detect and use symbol tables from this location. + Listing plugins ---------------