5

So far I'm hitting a brick wall here. Trying to capture memory from a Solaris 11 machine and nothing seems to work.

  • I've tried compiling and using LiME, to no avail
  • I've tried memdump, gives me garbage output
  • Done hours of research, can't find any tools like memoryze, DumpIt, FTKImager, etc... for Unix systems.
  • I've tried dumpadm (builtin command) with savecore but the files aren't in a format that is recognized by rekall, not even sure what it's producing.
  • Tried dd of the /dev/mem and /dev/kmem files. /dev/kmem fails, /dev/mem only copies about 600M of memory (Out of 4G) and the image isn't recognizable by rekall.

Looking for a tool or procedure that will allow me to create a .img or .raw file of the memory.

I'm not asking anyone to do this for me, but a point in the right direction would be amazing.

  • 1
    @techraf thank you for the edit. I was at the end of an already extremely frayed rope, been working at this for three days now. I appreciate the proper formatting and markup. – joel Jul 8 '16 at 14:19
1

Standard Linux kernel programs won’t work with Solaris.

You will need to follow the procedure that Sun specifies for dumping a live system, and use their tool (mdb) for analysing. Note that dumping a live system requires configuring the dedicated service to support it.

https://docs.oracle.com/cd/E23824_01/html/821-1451/tscrashdumps-4.html#tscrashdumps-32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.