Analyzing Volatile Memory on a Google Kubernetes Engine Node

This post details a novel method for performing memory analysis on GKE nodes by leveraging AVML for kernel memory dumps, dwarf2json for building kernel symbol files (using an undocumented API to access vmlinux from COS build IDs), and Volatility 3 for analysis. It demonstrates how to achieve this by using a privileged container to access /proc/kcore and outlines the architecture and steps involved.