Awesome GitHub RepositoriesMemory Analysis Tools

Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com

MemProcFS 是一个易失性内存分析工具和跨平台内存获取系统。它作为一个内存取证虚拟文件系统，将物理内存和内核对象映射到虚拟目录结构中，允许用户使用标准文件系统工具分析系统工件。 该项目通过提供用于内存取证的虚拟文件系统脱颖而出，能够将物理内存作为只读文件和文件夹进行浏览和查询。它还结合了基于 Yara 的内存扫描器，以识别物理内存中的恶意软件签名和注入代码。 该引擎涵盖了广泛的取证功能，包括进程和线程检查、网络连接列表和 Windows 注册表分析。它支持从实时系统、崩溃转储和虚拟机中摄取数据，同时提供符号解析以将原始内存地址转换为有意义的名称。 集成通过多语言程序化接口和针对 C 和 Java 的原生库包装器，以及用于自动化工作流的无头 Python 脚本提供支持。

Volatility3 是一个内存取证框架和分析工具，用于解析易失性内存转储。它提取数字工件并重构系统的运行时状态，以恢复进程信息、网络工件和其他取证证据。 该系统作为一个基于插件的取证引擎和操作系统符号解析器运行。它使用符号表和转换层将原始内存地址映射到已知的系统结构，并为创建自定义扫描器和渲染器提供了可扩展的架构。 该框架包含一个用于实时数据发现的命令行内存浏览器，以及一个用于自动化生成内存报告的编程接口。它通过基于层的地址转换过程处理数字工件提取和系统符号解析。

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisitio

AVML - Acquire Volatile Memory for Linux

Volatility plugin for extracts configuration data of known malware

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

The Volatility Collaborative GUI

Web interface for the Volatility Memory Forensics Framework

VolDiff: Malware Memory Footprint Analysis based on Volatility