AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed.
AVML supports source discovery (/dev/crash, /proc/kcore, and /dev/mem currently supported), exporting recorded memory via Azure Blob Stores (including automatic-retry in case of network issues) or HTTP PUT (which enables S3 support), and compression via Snappy.
We’ve tested AVML against a large number of distributions & releases including Ubuntu (from 12.04 and later), Centos (from 6.5 and later), RHEL (from 6.7 and later), Debian (from 8.0 and later), Oracle Linux (from 6.8 and later), and multiple point releases of CoreOS and SLES.