Aw: Re: Aw: Re: [Vol-users] KVM and Memory Dump

chris-2012 at arcor.de chris-2012 at arcor.de
Mon Oct 7 12:20:51 CDT 2013


Hi, 

> Same here, I'm trying to get the KVM memory dump to work... but it's weird.
> Situation: KVM + libvirt + volatility (from SVN trunk tonight) and a VM 
> running WinXP SP3x86:

> So despite imageinfo having a correct guess the profile doesn't fit. 
> What am I doing wrong?
>   Being able to analyse KVM images using libvirt would be quiet awesome.

I had the same problem. You have to convert the image with https://github.com/juergh/lqs2mem

Chris


More information about the Vol-users mailing list