Amazon Linux Memory...
 
Notifications
Clear all

Amazon Linux Memory Dump Success ?

1 Posts
1 Users
0 Reactions
888 Views
(@capovelli)
Posts: 2
Active Member
Topic starter
 

Good Day,

Has anyone been successful in acquiring a clean memory dump from an Amazon Linux EC2 instance (Amazon Linux 2023)? Creating/Running it through a custom profile in Volatility2/3 ?

I have tried to do this utilizing LiME, I get some error messages, such as

  • Skipping BTF generation …. Due to unavailability of vmlinux

If I then source the vmlinux file and put in the required directory which ‘make’ looks for I then get the following error:

  • /bin/sh: line1: ./tools/bpf/resolve_btfids/resolve_btfids: No such file or directory

 

I have tried creating custom profiles using Volatility 2 and 3 and it never works when reading the memory dump. Either the memory dump is not good or the profile just can load the kernel correctly.

I believe I have installed all the relevant kernel headers, debug tools etc.. But I can’t get this to work.

I just want to know if someone has been successful in

  1. Getting a clean memory dump with LiME with no errors
  2. Creating a custom profile for the memory dump with Volatility

 

Any input would be much appriciated.

 
Posted : 31/08/2023 11:26 am
Share: