| Subject: | RFE - expose QEmu pmemsave or qemu_monitor_command |
I do malicious code analysis under virtual machines, and am using
Sys::Virt to automate some of my analysis, e.g. creating a
non-persistent VM based on another VM's disk image w/ a qcow2 file for
copy-on-write, snapshots, etc.
Sometimes I need to get a physical memory dump of a VM for analysis
under utilities like the volatility framework(*1), which prefers
pmemsave dumps, and chokes on the core dumps created by
$vmm->core_dump(), which appears to be the qemu memsave command. Any
chance I could get a core dump that is of the pmemsave flavor?
https://www.volatilesystems.com/default/volatility