WinPmem

WinPmem -- 物理内存采集工具 WinPmem 长期以来一直是 Windows 上默认的开源内存采集驱动程序。它原本属于 Rekall 项目，但最近已被分离到自己的仓库中。 这是 Windows 版本。 Linux 版本 Linpmem 位于：https://github.com/Velocidex/Linpmem 版权 此代码最初由 Google 内部开发，但已根据 Apache 许可证发布。 描述 WinPmem 是一款具有以下特性的物理内存采集工具： 开源 支持 Win7 - Win 10，x86 + x64。可使用 WDK7600 来包含对 WinXP 的支持。...

rekall

Rekall discontinuation This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall. The modularity allow...

rekall

Rekall 项目终止 该项目不再维护。 2011年12月，Volatility 项目内创建了一个新分支，旨在探索如何使代码库更加模块化、提升性能并增强可用性。该分支后来被分叉，发展成为 Rekall。模块化特性使得物理内存分析功能能够用于 GRR，从而实现远程实时内存分析。 经验教训： 多年来，Rekall 在内存分析方法论方面引入了许多改进。更多信息请参阅：http://blog.rekall-forensic.com/ 由于内存中结构相互依赖的特性以及早期架构决策，Rekall 框架仅能实现有限的模块化。 不断增大的内存容量以及内存加密等安全措施，使得传统的物理内存分析变得更加繁琐...

Finding Evil in Windows 10 Compressed Memory, Part Two: Virtual Store Deep Dive

Introduction This blog post is the second in a three-part series covering our Windows 10 memory forensics research and it coincides with our BlackHat USA 2019 presentation. In Part One of the series, we covered the integration of the research in both Volatily and Rekall memory forensics tools. We...

Finding Evil in Windows 10 Compressed Memory, Part One: Volatility and Rekall Tools

Paging all digital forensicators, incident responders, and memory manager enthusiasts! Have you ever found yourself at a client site working around the clock to extract evil from a Windows 10 image? Have you hit the wall at step zero, running into difficulties viewing a process tree, or enumerati...

rVMI: Perform Full System Analysis with Ease

Manual dynamic analysis is an important concept. It enables us to observe the behavior of a sophisticated malware sample or exploit by executing it in a controlled environment. The information gathered through this process is often crucial in gaining a full understanding of a sample. When...

rVMI: Perform Full System Analysis with Ease

Manual dynamic analysis is an important concept. It enables us to observe the behavior of a sophisticated malware sample or exploit by executing it in a controlled environment. The information gathered through this process is often crucial in gaining a full understanding of a sample. When...

rVMI: Perform Full System Analysis with Ease

Manual dynamic analysis is an important concept. It enables us to observe the behavior of a sophisticated malware sample or exploit by executing it in a controlled environment. The information gathered through this process is often crucial in gaining a full understanding of a sample. When...

Rekall - Rekall Memory Forensic Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but...

Rekall - The Most Complete Memory Analysis Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but...

Rekall Memory Forensic Framework

Rekall is an advanced forensic and incident response framework. While it began life purely as a memory forensic framework, it has now evolved into a complete platform. Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and op...

[Rekall] Memory Forensics Analysis Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but...