ufrisk/MemProcFS

Features

• Memory Analysis - Implements a comprehensive engine for acquiring and analyzing volatile system memory and static memory dumps.
• Memory Forensics - Analyzes physical memory dumps or live system state to identify security threats and recover system artifacts.
• Volatile Memory Acquisition Tools - Provides a cross-platform system for capturing volatile memory from live systems, virtual machines, and remote agents.
• Debug Symbol Resolvers - Downloads and caches symbols from remote servers to translate raw memory addresses into meaningful function names.
• YARA Rule Execution - Identifies malicious patterns in process and kernel virtual address spaces using compiled or source YARA rule sets.
• Virtual File Systems - Maps physical memory and kernel artifacts into a virtual directory structure for analysis via standard file system tools.
• Forensic Memory Virtualization - Exposes physical memory and kernel objects as a virtualized directory structure of read-only files and folders.
• Forensic Agent Communication - Minimizes network bandwidth by transmitting only file system access requests to remote analysis agents.
• Memory Dump Parsers - Parses memory dump files across various CPU architectures to enable deep forensic analysis.
• Remote Memory Filesystems - Acquires remote physical memory and presents it as a local virtual filesystem for exploration.
• Physical and Virtual Memory Operations - Performs direct read and write operations on physical and virtual memory for specific processes or system-wide.
• Thread Inspection - Exposes thread-specific data including kernel structures and stacks as files within a virtual directory.
• Volatile Memory Ingestion - Ingests memory data from raw dump files, crash dumps, live captures, or hardware interfaces for analysis.
• Binary Pattern Searching - Scans memory for specific binary patterns or signatures using regular expressions and YARA rules.
• Hardware Memory Acquisition Tools - Captures volatile RAM via drivers, virtual machines, hardware interfaces, or remote agents for real-time incident response.
• Memory Malware Analysis - Scans system memory for malicious patterns and injected code using tools like Yara rules.
• Process Enumeration - Identifies running software by retrieving a collection of active processes from the targeted memory source.
• Remote Memory Analysis - Analyzes memory on remote machines and optimizes network bandwidth by transmitting only specific file system access requests.
• YARA-Based Scanning - Uses compiled Yara rules to scan physical and virtual address spaces for malicious signatures and injected code.
• Process Metadata Inspection - Retrieves detailed process lists, module bases, function addresses, and memory maps including heaps and page table entries.
• DNS Cache Recovery - Extracts DNS records cached by the operating system and presents them as searchable text files.
• Headless Forensic Scripting - Executes automated Python scripts at startup to perform forensics without mounting a virtual file system.
• Multi-Language Plugin Frameworks - Supports custom forensic capabilities through a modular system allowing extensions written in multiple programming languages.
• Memory Analysis APIs - Offers a multi-language programmatic interface to read physical and virtual process memory without mounting a file system.
• Kernel Object Reconstruction - Recovers file objects from the kernel pool and process handles to present a reconstructed file system.
• DMA Memory Acquisition - Provides capabilities to acquire system memory by bypassing the CPU via hardware interfaces such as PCIe DMA.
• Forensic Memory Mapping - Maps physical memory and system artifacts into a virtual file system for analysis with standard tools.
• Virtual Address Translators - Translates guest physical addresses to host physical or virtual addresses within a virtual machine environment.
• Page File Integration - Incorporates disk-based page files into the memory analysis engine to recover data swapped out of physical RAM.
• Guest-to-Host Address Translation - Translates guest physical addresses to host virtual addresses to enable memory analysis within hypervisor-based virtual machines.
• Programmatic Memory Interfaces - Integrates memory analysis capabilities into custom applications using native libraries or multi-language interfaces.
• Guest-to-Host Address Translation - Extracts and translates guest memory from hypervisors to analyze the state of virtualized operating systems.
• Memory Dump Visualizers - Exposes physical memory as a virtual file system to analyze memory dumps or live memory.
• Guest Memory Parsing - Extracts the memory of hypervisor-based virtual machines and presents them as separate file systems for analysis.
• Virtual Machine Detection - Identifies supported virtual machines in memory and mounts them as separate file systems or memory views.
• Windows Registry Interfaces - Enumerates registry hives and provides interfaces to read or write their memory space for configuration analysis.
• Memory-Based File Recovery - Extracts files from memory by locating process file handles and copying the associated data.
• Evasion Technique Detection - Identifies evasion techniques like process hollowing by flagging discrepancies between process structures and image addresses.
• Incident Response Triage - Connects to remote hosts or virtual machines to rapidly acquire and analyze volatile memory during investigations.
• Injected Module Detection - Locates executable modules in private virtual address descriptors to identify hidden malware.
• Memory Event Log Extraction - Exposes event logs found in physical memory as read-only files for use with external log viewers.
• Process Callstack Analysis - Analyzes runtime callstacks of user-mode threads to identify function call traces using symbol resolution.
• User-Mode Malware Detection - Scans physical memory for indicators of malicious activity like code injection and presents results as files.
• Modular Plugin Architectures - Adds custom forensic capabilities through a modular architecture that supports multiple programming languages for extensions.
• Active Connection Monitors - Displays active TCP connections, including addresses and associated process names, as a text file.
• System Information Summaries - Provides a high-level overview of the kernel, operating system, and active users via a read-only text file.
• Memory Forensics - Accesses physical memory as a virtual file system.
• Digital Forensics - Tool for accessing physical memory as a virtual file system.
• Memory Analysis Tools - Virtual file system for viewing physical memory as files.
• Memory Forensics - Virtual file system for accessing physical memory.

Star history