I've run into some issues trying to use the profile for OS X 10.11.3. The same issue seems to appear for the 10.11.1 and 10.11.2 profiles.
I'm sure I'm missing something simple, but haven't figured it out yet. This is using a clean clone of volatility from git on OS X 10.11 (Have also tested on a Linux box).
$ python volatility/vol.py -v -f/Volumes/VMs/OS\ X\ 10.11.vmwarevm/OS\ X\ 10.11-Snapshot1.vmem imageinfo
Volatility Foundation Volatility Framework 2.5
INFO : volatility.debug : Determining profile based on KDBG search...
Traceback (most recent call last):
File "volatility/vol.py", line 192, in <module>
main()
File "volatility/vol.py", line 183, in main
command.execute()
File "/Users/tribalchicken/Desktop/volatility/volatility/commands.py", line 147, in execute
func(outfd, data)
File "/Users/tribalchicken/Desktop/volatility/volatility/plugins/imageinfo.py", line 45, in render_text
for k, t, v in data:
File "/Users/tribalchicken/Desktop/volatility/volatility/plugins/imageinfo.py", line 55, in calculate
suglist = [ s for s, _ in kdbgscan.KDBGScan.calculate(self)]
File "/Users/tribalchicken/Desktop/volatility/volatility/plugins/kdbgscan.py", line 116, in calculate
buf = addrspace.BufferAddressSpace(self._config)
File "/Users/tribalchicken/Desktop/volatility/volatility/addrspace.py", line 378, in __init__
BaseAddressSpace.__init__(self, None, config, **kwargs)
File "/Users/tribalchicken/Desktop/volatility/volatility/addrspace.py", line 73, in __init__
self.profile = self._set_profile(config.PROFILE)
File "/Users/tribalchicken/Desktop/volatility/volatility/addrspace.py", line 98, in _set_profile
ret = profs[profile_name]()
File "/Users/tribalchicken/Desktop/volatility/volatility/plugins/overlays/mac/mac.py", line 1810, in __init__
obj.Profile.__init__(self, *args, **kwargs)
File "/Users/tribalchicken/Desktop/volatility/volatility/obj.py", line 859, in __init__
self.reset()
File "/Users/tribalchicken/Desktop/volatility/volatility/plugins/overlays/mac/mac.py", line 1830, in reset
self.compile()
File "/Users/tribalchicken/Desktop/volatility/volatility/obj.py", line 960, in compile
self.types[name] = self._convert_members(name)
File "/Users/tribalchicken/Desktop/volatility/volatility/obj.py", line 1235, in _convert_members
members[k] = (v[0], self._list_to_type(k, v[1], self.vtypes))
File "/Users/tribalchicken/Desktop/volatility/volatility/obj.py", line 1152, in _list_to_type
if typeList[0] == 'void':
TypeError: 'int' object has no attribute '__getitem__'
...
DEBUG : volatility.debug : Applying modification from VMwareVTypesModification
DEBUG : volatility.debug : Applying modification from VirtualBoxModification
DEBUG : volatility.debug : Applying modification from MacObjectClasses
DEBUG : volatility.debug : Applying modification from MacObjectClasses2
DEBUG : volatility.debug : Applying modification from MacObjectClasses4
DEBUG : volatility.debug : Applying modification from MacOverlay
DEBUG : volatility.debug : Applying modification from MachoOverlay
> /Users/tribalchicken/Desktop/volatility/volatility/obj.py(1152)_list_to_type()
-> if typeList[0] == 'void':
(Pdb)
Interestingly enough, attempting to build my own profile on an 10.11.3 VM yields a different error - But that will probably be a different issue (or a user issue - haven't looked at it too much).
Let me know if I can provide any other info.