Re: [Xen-users] forensics investigation of xl dump-core memory image?

["J. Eppler" <j.eppler@xxxxxxxxxxxxxxx>]

On 06/15/2016 03:14 AM, Roger Pau Monné wrote:
> Hello,
>
> On Mon, Jun 13, 2016 at 09:01:20AM -0500, J. Eppler wrote:
>> Hello,
>>
>> - what tools are able to investigate a xl dump-core memory image?
> That, AFAIK, depends on the OS that was running.
Qubes OS R3.1, Xen 4.6 Linux Kernel 4.1 with some Qubes modification is
used in both Dom0 as well as DomU guests. Guest could be Fedora, Debian
and Archlinux.

Futhermore Qubes OS supports Windows 7.

I am interested in analyzing any of them.
>
>> - is it possible to investigate the memory images by using volatility?
> It depends on whether volatility is able to understand the Xen dump-core 
> format [0], you should ask them.
Thanks for clarification.
>
> Roger.
>
> [0] http://xenbits.xen.org/docs/unstable/misc/dump-core-format.txt
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxx
> http://lists.xen.org/xen-users



_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users