Portable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote streaming.
A portable volatile memory acquisition tool for Linux.
AVML is a Linux userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed.
Release builds are produced for x86-64, AArch64, ARMv7 little-endian hard-float, and legacy ARMv6-compatible big-endian systems. ARMv7 acquisition currently assumes 4096-byte memory pages.
Before producing output, AVML validates the source's memory ranges and reads
its first chunk (up to 16 MiB). If no source is specified, it tries /proc/kcore,
then /dev/crash, then /dev/mem until validation succeeds. The selected source
handle and buffered chunk are retained for acquisition. A later read or write
failure ends acquisition; AVML does not switch sources after validation.
Local acquisition and conversion outputs must not already exist. AVML creates
them exclusively and refuses existing files, hard links, and destination
symlinks. On Unix only, exactly /dev/null and /dev/stdout are opened for
writing without creation or truncation. A failed acquisition can leave a partial
local output; use a new path or remove that file before retrying.
NOTE: If the kernel feature kernel_lockdown is enabled, AVML will not be able to acquire memory.
The Azure VM test matrix is defined in eng/images.txt and currently covers:
avml is a single binary with subcommands. Each subcommand is gated by
a Cargo feature so a minimal build only includes the capability you need:
| Subcommand | Feature | Default | What it does |
|---|---|---|---|
acquire | (always) | yes | Snapshot memory to a local file (optional upload after). |
convert | convert | yes | Convert between AVML / LiME / raw formats. |
upload | upload | yes | Upload a local file via HTTP PUT or to Azure Block Blob. |
stream | stream | yes | Stream a snapshot directly to a destination, no local file. |
Build a minimal acquire-only binary with cargo build --release --no-default-features.
On the target host:
avml acquire --compress output.lime.compressed
On the target host:
avml acquire output.lime
On a secure host with az cli credentials, generate a SAS URL.
EXPIRY=$(date -d '1 day' '+%Y-%m-%dT%H:%MZ')
SAS_URL=$(az storage blob generate-sas --account-name ACCOUNT --container CONTAINER test.lime --full-uri --permissions c --output tsv --expiry ${EXPIRY})
On the target host, execute avml with the generated SAS token.
avml acquire --sas-url ${SAS_URL} --delete output.lime
For hosts where writing the snapshot to a local file first is undesirable
(read-only root, limited disk, forensic chain-of-custody concerns), use
the stream subcommand. It uses the same source validation and selection as
acquire (pass --source to override) and writes bytes sequentially to the
chosen destination. Sources are tried only during validation, before any output
bytes are sent. The source cannot be changed mid-stream.
avml stream blob ${SAS_URL}
--sas-block-size (MiB) acts as
a floor; if the derived minimum is larger, the larger value wins.--sas-block-concurrency caps the number of in-flight stage_block
calls. Peak RAM is approximately (concurrency + 1) * block_size.On the collector host:
nc -l 9000 > snapshot.lime
On the target host:
avml stream tcp collector.example.com:9000
avml connects once and writes the snapshot sequentially. If the connection drops mid-stream, the snapshot aborts; there is no resume. No TLS — pair with an SSH tunnel or stunnel for confidentiality and integrity if needed.
avml upload put ./output.lime ${URL} # HTTP PUT
avml upload blob ./output.lime ${SAS_URL} # Azure Block Blob
On a secure host with az cli credentials, do the following:
config.json containing the following information:{
"commandToExecute": "./avml acquire --compress --sas-url <GENERATED_SAS_URL> --delete",
"fileUris": ["https://FULL.URL.TO.AVML.example.com/avml"]
}
config.jsonaz vm extension set -g RESOURCE_GROUP --vm-name VM_NAME --publisher Microsoft.Azure.Extensions -n customScript --settings config.json
On a secure host, generate a S3 pre-signed URL or generate a GCP pre-signed URL.
On the target host, execute avml with the generated pre-signed URL.
avml acquire --url ${URL} --delete output.lime
avml convert ./compressed.lime ./uncompressed.lime
avml convert --source-format lime --format lime_compressed ./uncompressed.lime ./compressed.lime
A portable volatile memory acquisition tool for Linux
Usage: avml <COMMAND>
Commands:
acquire Acquire a memory snapshot to a local file (and optionally upload it)
convert Convert between AVML and LiME snapshot formats and a raw memory image
upload Upload an already-acquired snapshot file to remote storage
stream Stream a memory snapshot directly to remote storage, without writing it to a local file
help Print this message or the help of the given subcommand(s)
Run avml <COMMAND> --help for per-command options.
# Install MUSL
sudo apt-get install musl-dev musl-tools musl
# Install Rust via rustup
curl https://sh.rustup.rs -sSf | sh -s -- -y
# Add the MUSL target for Rust
rustup target add x86_64-unknown-linux-musl