Skip to content

Latest commit

 

History

History
23 lines (18 loc) · 1.18 KB

README.md

File metadata and controls

23 lines (18 loc) · 1.18 KB
Raw

Linux Coredump

Linux Coredump is a volatility plugin that attempts to create a core dump file starting from the memory of a Linux process.

Usage

  • Clone or download the linux_coredump plugin.

  • Issue the command:

    volatility --plugins=<path of extracted linux_coredump dir> --profile=<memory profile> -f <memory dump> linux_coredump --pid <process pid> --dump-dir <output dir> --output-file <output file>

    or

    vol.py --plugins=<path of extracted linux_coredump dir> --profile=<memory profile> -f <memory dump> linux_coredump --pid <process pid> --dump-dir <output dir> --output-file <output file>

Depending on how you installed volatility (from apt or github).

The plugin will output the corefile in the specified directory and with the specified file name.

NOTES

  • The --plugins option must be the first option.
  • The plugin may require some time for processes that use a lot of memory (up to 15-20 minutes).
  • The volatility version installed using apt differs from the one present in github. This latter version probably has a bug and does not show the name of the process memory mappings.