Commit 8f1a5c3a authored by Tails developers's avatar Tails developers
Browse files

Add instructions for dumping the memory of a VirtualBox guest.

parent fae4e98a
......@@ -7,6 +7,8 @@
Pick one of those:
* [[erase_memory_on_shutdown/qemu_pmemsave]] (pros: no initial setup)
* [[erase_memory_on_shutdown/virtualbox_dumpguestcore.mdwn]]
(pros: no initial setup)
* [[erase_memory_on_shutdown/pxedump]] (pros: works for bare metal,
possible to `|grep` and avoid writting the huge dump file to disk;
cons: initial setup)
......
Run the following from the host:
vboxmanage debugvm "${VM_NAME}" dumpguestcore --filename tails.dump
and that's it.
VirtualBox' VM core is an ELF that contains [some headers and other
state](http://www.virtualbox.org/manual/ch12.html#guestcoreformat) of
the Tails guest in addition to the memory dump, but there's no
reasonable possibility of finding the pattern as false positives there
so there's no reason to bother cutting the headers away.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment