-
Notifications
You must be signed in to change notification settings - Fork 396
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
correct way to dump the memory of a process with volatility 3 ? #365
Comments
The reference you're referring to is for a completely different version of volatility. Please note that volatility 3 has been completely rewritten and does not attempt to precisely match every previous command line option. For volatility 3, there's a difference between global options (like In this instance, the command you're looking for would be:
Hopefully this answers your question. If you have more questions like this you might get a more interactive/quicker answer by joining our slack channel by going to https://www.volatilityfoundation.org/slack. Marking this as closed, but please feel free to reopen it if you don't feel it answered your question completely... 5:) |
Where can I see templates for such commands? It would be very convenient. |
So the This was mentioned in my initial response. If you're still discussing volatility 2, this is not the right location for those questions, they belong in the https://github.com/volatilityfoundation/volatility/ repository.
|
From andreafortuna/process memory
(or at https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#memdump) I see:
$ vol.py -f ~/Desktop/win7_trial_64bit.raw --profile=Win7SP0x64 memdump -p 4 -D dump/
From #227 I read that I should use
memmap --dump
instead$ volatility -f dump.vmem windows.memmap --dump -p 2380 --dump-dir=procdump/
which gives:
What is the correct way to dump the memory of a process and its opened files with volatility 3 ?
The text was updated successfully, but these errors were encountered: