2014-01-28 21:46:11 +00:00
|
|
|
For live system analysis, the physical memory source must be one
|
|
|
|
|
of the following devices:
|
|
|
|
|
|
|
|
|
|
/dev/mem
|
|
|
|
|
/proc/kcore
|
|
|
|
|
/dev/crash
|
|
|
|
|
|
2016-11-22 16:43:40 +00:00
|
|
|
If the live system kernel was configured with CONFIG_STRICT_DEVMEM
|
|
|
|
|
or CONFIG_HARDENED_USERCOPY, then /dev/mem cannot be used.
|
2014-01-28 21:46:11 +00:00
|
|
|
|
|
|
|
|
If the live system kernel was configured without CONFIG_PROC_KCORE,
|
|
|
|
|
or if /proc/kcore is non-functional, then /proc/kcore cannot be used.
|
|
|
|
|
|
|
|
|
|
The third alternative is this /dev/crash driver. Presuming that
|
|
|
|
|
/lib/modules/`uname -r`/build points to a kernel build tree or
|
|
|
|
|
kernel "devel" package tree, the module can simply be built and
|
|
|
|
|
installed like so:
|
|
|
|
|
|
|
|
|
|
# make
|
|
|
|
|
...
|
|
|
|
|
# insmod crash.ko
|
|
|
|
|
|
|
|
|
|
Once installed, the /dev/crash driver will be used by default for
|
|
|
|
|
live system crash sessions.
|
