Creating a Volatility profile
To create a macOS profile, we will need to install a few additional tools. First of all, we will need the Brew package manager, which can be installed by following the instructions from the official website: https://docs.brew.sh/Installation.
Basically, the only thing you need to do is to run the command located on the home page:
$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
The Brew manager is needed to install the dwarfdump
that we already know, so once brew
is installed, feel free to run the following command in the terminal:
$ brew install dwarf
The last thing to download is KernelDebugKit
. To do this, use this link: https://developer.apple.com/download/all/?q=debug. Note that in order to gain access, you will need an Apple ID, which you can create by clicking on the Create yours now
link. After entering your ID, you will see the Downloads page: