avml

AVML Acquire Volatile Memory for Linux 요약 Linux용 휴대용 휘발성 메모리 획득 도구. AVML은 Rust로 작성된 X8664 사용자 공간 휘발성 메모리 획득 도구로, 정적 바이너리로 배포되도록 설계되었습니다. AVML은 대상 OS 배포판이나 커널을 사전에 알지 못해도 메모리를 획득하는 데 사용할 수 있습니다. 대상에서의 컴파일이나 핑거프린팅이 필요하지 않습니다. 기능 Azure Blob Store 또는 HTTP PUT을 통해 기록된 이미지를 외부 위치에 저장 Azure Blob Storage...

gargamel

Gargamel Компиляция Скомпилировано и протестировано с Rust 1.50+. Откройте терминал в каталоге проекта и для компиляции релизной сборки введите cargo build --release Отладочную сборку можно скомпилировать с помощью cargo build Скомпилированный исполняемый файл находится в...

WinPmem

WinPmem -- инструмент для извлечения физической памяти WinPmem долгое время был драйвером для извлечения памяти с открытым исходным кодом в Windows. Ранее он находился в проекте Rekall, но недавно был отделен в собственный репозиторий. Это версия для Windows. Версия для Linux , Linpmem , находитс...

LiME

LiME Linux 메모리 추출기 Linux 및 Linux 기반 장치예: Android에서 휘발성 메모리를 획득하기 위한 로드 가능한 커널 모듈LKM입니다. LiME는 획득 과정에서 사용자 공간과 커널 공간 프로세스 간의 상호 작용을 최소화하여, Linux 메모리 획득용으로 설계된 다른 도구들보다 포렌식적으로 더 건전한 메모리 캡처를 생성합니다. 목차 기능 사용법 예제 사용 가능한 다이제스트 압축 발표 기능 Linux및 Android 시스템의 전체 메모리 획득 네트워크 인터페이스 또는 로컬 디스크로 획득 여러 출력 형식raw,...

pcileech

Краткое описание PCILeech: PCILeech использует аппаратные устройства PCIe для чтения и записи памяти целевой системы. Это достигается с помощью DMA поверх PCIe. Драйверы на целевой системе не требуются. PCILeech также работает без аппаратного обеспечения совместно с широким спектром программных...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

Linpmem

Linpmem – инструмент для захвата физической памяти для Linux Linpmem – это инструмент только для Linux x64 для чтения физической памяти. Как и его аналог для Windows, Winpmem, это не традиционный дампер памяти. Linpmem предоставляет API для чтения с любого физического адреса, включая...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a race condition in memory acquisition. This condition may lead to competition when sharing...

Bringing Forensic Readiness to Modern Computer Firmware

Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make ...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

Linpmem - A Physical Memory Acquisition Tool For Linux

Like its Windows counterpart, Winpmem, this is not a traditional memory dumper. Linpmem offers an API for reading from any physical address, including reserved memory and memory holes , but it can also be used for normal memory dumping. Furthermore, the driver offers a variety of access modes to...

WinPmem - The Multi-Platform Memory Acquisition Tool

The WinPmem memory acquisition driver and userspace WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. Copyright This code was originally developed within...

Linux Memory Extractor: LiME

Linux Memory Extractor LiME formerly DMD is A Loadable Kernel Module LKM which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its...

LiME - Linux Memory Extractor

A Loadable Kernel Module LKM which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space...

Rekall Memory Forensic Framework

Rekall is an advanced forensic and incident response framework. While it began life purely as a memory forensic framework, it has now evolved into a complete platform. Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and op...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...

[MoonSols] Windows Memory Toolkit

MoonSols Windows Memory Toolkit is a powerful toolkit containing all the utilities needed to perform any kind of memory acquisition or conversion during an incident response, or a forensic analysis for Windows desktops, servers or virtualized environment. The version 2.0 is a refresh and updated...