https://cybertoolchain.io/tools/avml New releases and features in AVML, tracked by The Cyber Toolchain. en Fri, 09 Oct 2026 18:56:06 GMT https://github.com/microsoft/avml/releases/tag/v0.21.0 https://github.com/microsoft/avml/releases/tag/v0.21.0 Fri, 09 Oct 2026 18:56:06 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.19.0 https://github.com/microsoft/avml/releases/tag/v0.19.0 Tue, 30 Jun 2026 18:25:11 GMT AVML v0.19.0 collapses all subcommands into one binary and adds a `stream` subcommand for diskless memory capture. • New `stream` subcommand streams a live memory snapshot directly to Azure Block Blob or a remote TCP listener without writing to local disk — ideal for read-only roots, limited-disk hosts, or forensic chain-of-custody requirements. • New `stream blob <SAS_URL>` destination pipes memory directly to Azure Block Blob Storage, auto-sizing block size to stay within Azure's 50,000-block limit; `--sas-block-size` (MiB) sets a floor and `--sas-block-concurrency` caps in-flight uploads. • New `stream tcp <host:port>` destination streams a snapshot over a raw TCP connection to a netcat-style collector. • All subcommands (`acquire`, `convert`, `upload`, `stream`) are now consolidated into a single `avml` binary instead of separate binaries. • Enforces that `--url` and `--sas-url` are mutually exclusive on `avml acquire`, and requires one of them when `--delete` is set — preventing silent misconfiguration. Breaking changes: • The `avml-upload` binary has been collapsed into `avml`; the separate `avml-upload` binary no longer exists. • `--url` and `--sas-url` are now mutually exclusive on `avml acquire`; previously both could be specified together. • `--delete` now requires `--url` or `--sas-url` to be set; previously `--delete` could be used without a remote URL. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.18.0 https://github.com/microsoft/avml/releases/tag/v0.18.0 Wed, 20 May 2026 21:26:21 GMT AVML v0.18.0 adds support for emitting kcore intersections that straddle PT_LOAD gaps and updates to GA Azure SDK. • Update to GA Azure SDK Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.15.0 https://github.com/microsoft/avml/releases/tag/v0.15.0 Wed, 26 Mar 2025 17:33:10 GMT AVML v0.15.0 adds arm64 build support for Linux memory acquisition on ARM-based systems. • Adds support for arm64 builds, enabling memory acquisition on ARM64 Linux systems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.10.0 https://github.com/microsoft/avml/releases/tag/v0.10.0 Tue, 24 Jan 2023 16:49:16 GMT v0.10.0 adds `--max-disk` flags to limit disk utilization during memory acquisition • Expose optional disk utilization limits via new `--max-disk-available-pct` and `--max-disk-write-speed-mbps` CLI arguments • Switch SAS URL parsing from custom implementation to Azure SDK Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.7.0 https://github.com/microsoft/avml/releases/tag/v0.7.0 Fri, 17 Jun 2022 18:04:39 GMT AVML v0.7.0 adds --version flag to avml-convert and optional upload status indicators • `avml-convert` now supports the `--version` flag to print the tool's version number Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.5.0 https://github.com/microsoft/avml/releases/tag/v0.5.0 Wed, 09 Feb 2022 21:07:37 GMT Adds `BlobUploader` API and enables concurrent blob block uploads in v0.5.0. • `BlobUploader` api to ease writing streams concurrently to blob storage • enable concurrent uploads of blob blocks to Azure Storage accounts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml https://github.com/microsoft/avml/releases/tag/v0.4.1 https://github.com/microsoft/avml/releases/tag/v0.4.1 Wed, 26 Jan 2022 21:34:42 GMT Adds `avml-upload` command for direct Azure blob upload. • skip 1MB blocks of nulls when running with --compress Full history on Cyber Toolchain: https://cybertoolchain.io/tools/avml