Memory dump on Ubuntu 18.04 failed on too big /proc/kcore/

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












2














There are two great articles about how to aquire memory on Linux using linpmem:



SANS
holdmybeersecurity



Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be a more general problem:




wget https://github.com/google/rekall/releases/download/v1.5.1/linpmem-2.1.post4
chmod +x linpmem-2.1.post4
./linpmem-2.1.post4 -o mem.aff4r



Is running directly and creating a big file (stopped it > 160GB). Checking linpmem more closly it relies on linux memory mapping /proc/kcore to acquire the data.




sudo ls -lh /proc/kcore
-r-------- 1 root root 128T Dec 12 11:32 /proc/kcore



This is huge! As stated here...




... /proc/kcore is the virtual allocation of your RAM for the kernel. On 64 bit systems that size can be an absolute limit of 128T since that is the most the system can allocate.




which is kind of against the man proc:



 /proc/kcore
This file represents the physical memory of the system and is stored in the ELF core file format. With this pseudo-file, and an unstripped kernel
(/usr/src/linux/vmlinux) binary, GDB can be used to examine the current state of any kernel data structures.

The total length of the file is the size of physical memory (RAM) plus 4 KiB.


So the big question is: How to aquire the memory/swap only, but not the HDD content?










share|improve this question


























    2














    There are two great articles about how to aquire memory on Linux using linpmem:



    SANS
    holdmybeersecurity



    Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be a more general problem:




    wget https://github.com/google/rekall/releases/download/v1.5.1/linpmem-2.1.post4
    chmod +x linpmem-2.1.post4
    ./linpmem-2.1.post4 -o mem.aff4r



    Is running directly and creating a big file (stopped it > 160GB). Checking linpmem more closly it relies on linux memory mapping /proc/kcore to acquire the data.




    sudo ls -lh /proc/kcore
    -r-------- 1 root root 128T Dec 12 11:32 /proc/kcore



    This is huge! As stated here...




    ... /proc/kcore is the virtual allocation of your RAM for the kernel. On 64 bit systems that size can be an absolute limit of 128T since that is the most the system can allocate.




    which is kind of against the man proc:



     /proc/kcore
    This file represents the physical memory of the system and is stored in the ELF core file format. With this pseudo-file, and an unstripped kernel
    (/usr/src/linux/vmlinux) binary, GDB can be used to examine the current state of any kernel data structures.

    The total length of the file is the size of physical memory (RAM) plus 4 KiB.


    So the big question is: How to aquire the memory/swap only, but not the HDD content?










    share|improve this question
























      2












      2








      2


      1





      There are two great articles about how to aquire memory on Linux using linpmem:



      SANS
      holdmybeersecurity



      Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be a more general problem:




      wget https://github.com/google/rekall/releases/download/v1.5.1/linpmem-2.1.post4
      chmod +x linpmem-2.1.post4
      ./linpmem-2.1.post4 -o mem.aff4r



      Is running directly and creating a big file (stopped it > 160GB). Checking linpmem more closly it relies on linux memory mapping /proc/kcore to acquire the data.




      sudo ls -lh /proc/kcore
      -r-------- 1 root root 128T Dec 12 11:32 /proc/kcore



      This is huge! As stated here...




      ... /proc/kcore is the virtual allocation of your RAM for the kernel. On 64 bit systems that size can be an absolute limit of 128T since that is the most the system can allocate.




      which is kind of against the man proc:



       /proc/kcore
      This file represents the physical memory of the system and is stored in the ELF core file format. With this pseudo-file, and an unstripped kernel
      (/usr/src/linux/vmlinux) binary, GDB can be used to examine the current state of any kernel data structures.

      The total length of the file is the size of physical memory (RAM) plus 4 KiB.


      So the big question is: How to aquire the memory/swap only, but not the HDD content?










      share|improve this question













      There are two great articles about how to aquire memory on Linux using linpmem:



      SANS
      holdmybeersecurity



      Trying the approach from holdmybeersecurity I ran into the following issue, which seems to be a more general problem:




      wget https://github.com/google/rekall/releases/download/v1.5.1/linpmem-2.1.post4
      chmod +x linpmem-2.1.post4
      ./linpmem-2.1.post4 -o mem.aff4r



      Is running directly and creating a big file (stopped it > 160GB). Checking linpmem more closly it relies on linux memory mapping /proc/kcore to acquire the data.




      sudo ls -lh /proc/kcore
      -r-------- 1 root root 128T Dec 12 11:32 /proc/kcore



      This is huge! As stated here...




      ... /proc/kcore is the virtual allocation of your RAM for the kernel. On 64 bit systems that size can be an absolute limit of 128T since that is the most the system can allocate.




      which is kind of against the man proc:



       /proc/kcore
      This file represents the physical memory of the system and is stored in the ELF core file format. With this pseudo-file, and an unstripped kernel
      (/usr/src/linux/vmlinux) binary, GDB can be used to examine the current state of any kernel data structures.

      The total length of the file is the size of physical memory (RAM) plus 4 KiB.


      So the big question is: How to aquire the memory/swap only, but not the HDD content?







      ubuntu memory dump






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Dec 12 at 12:05









      gies0r

      1112




      1112

























          active

          oldest

          votes











          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "106"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487563%2fmemory-dump-on-ubuntu-18-04-failed-on-too-big-proc-kcore%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown






























          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Unix & Linux Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.





          Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


          Please pay close attention to the following guidance:


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487563%2fmemory-dump-on-ubuntu-18-04-failed-on-too-big-proc-kcore%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown






          Popular posts from this blog

          How to check contact read email or not when send email to Individual?

          Displaying single band from multi-band raster using QGIS

          How many registers does an x86_64 CPU actually have?