5

So far I'm hitting a brick wall here. Trying to capture memory from a Solaris 11 machine and nothing seems to work.

  • I've tried compiling and using LiME, to no avail
  • I've tried memdump, gives me garbage output
  • Done hours of research, can't find any tools like memoryze, DumpIt, FTKImager, etc... for Unix systems.
  • I've tried dumpadm (builtin command) with savecore but the files aren't in a format that is recognized by rekall, not even sure what it's producing.
  • Tried dd of the /dev/mem and /dev/kmem files. /dev/kmem fails, /dev/mem only copies about 600M of memory (Out of 4G) and the image isn't recognizable by rekall.

Looking for a tool or procedure that will allow me to create a .img or .raw file of the memory.

I'm not asking anyone to do this for me, but a point in the right direction would be amazing.

Improve this question
1
  • 1
    @techraf thank you for the edit. I was at the end of an already extremely frayed rope, been working at this for three days now. I appreciate the proper formatting and markup.
    – joel
    Jul 8, 2016 at 14:19

1 Answer 1

Reset to default
1

Standard Linux kernel programs won’t work with Solaris.

You will need to follow the procedure that Sun specifies for dumping a live system, and use their tool (mdb) for analysing. Note that dumping a live system requires configuring the dedicated service to support it.

https://docs.oracle.com/cd/E23824_01/html/821-1451/tscrashdumps-4.html#tscrashdumps-32

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .