VolExp

VolExp Volatility Explorer 该程序允许用户访问内存转储。它也可以作为 Volatility 框架（https://github.com/volatilityfoundation/volatility）的插件运行。 该程序的功能类似于 Process Explorer/Hacker，但此外它还允许用户访问内存转储（或使用 Memtriage 访问计算机的实时内存）。 该程序可在 Windows、Linux 和 MacOS 机器上运行，但只能使用 Windows 内存映像。 注意：针对 volatility3 的 volatility...

VolExp - Volatility Explorer

This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access to a Memory Dump or access...

Query Windows Machine for RAM Artifacts: memtriage

Allows you to quickly query a live Windows machine for RAM artifacts. This tool utilizes the Winpmem drivers to access physical memory, and Volatility for analysis. Caveats: Doesn’t work with Device Guard enabled. Should be tested on machines before deploying. Example Usage usage: memtriage.exe -...