Currently, when using dd(1) to take a VM memory image, the capture never ends,
reading zeroes when it's beyond VM system memory max address.
Return EFAULT when trying to read beyond VM system memory max address.
With the patch, I'm able to take a memory image from a windows guest with dd(1)
and analyse it with tools like volatility or rekall.
Details
Details
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Passed - Unit
No Test Coverage - Build Status
Buildable 16253 Build 16202: arc lint + arc unit
Event Timeline
Comment Actions
Good to go with the name change.
sys/amd64/include/vmm.h | ||
---|---|---|
215 | Can the name for this be changed to vmm_sysmem_maxaddr ? |