The Memory Process File System (MemProcFS) is an easy and convenient way of viewing physical memory as files in a virtual file system.
Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or via a feature rich application library to include in your own projects!
Analyze memory dump files, live memory via DumpIt or WinPMEM, live memory in read-write mode via linked PCILeech and PCILeech-FPGA devices!
It's even possible to connect to a remote LeechAgent memory acquisition agent over a secured connection - allowing for remote live memory incident response - even over higher latency low band-width connections! Peek into Hyper-V Virtual Machines with LiveCloudKd!
Use your favorite tools to analyze memory - use your favorite hex editors, your python and powershell scripts, WinDbg or your favorite disassemblers and debuggers - all will work trivally with MemProcFS by just reading and writing files!
Include MemProcFS in your C/C++, C#, Java or Python programming projects! Everything in MemProcFS is exposed via an easy-to-use API for use in your own projects! The Plugin friendly architecture allows users to easily extend MemProcFS with native C .DLL plugins or Python .py plugins - providing additional analysis capabilities!
MemProcFS is available on Python pip. Just type pip install memprocfs
and you're ready to go! Please see the Python API documentation and the YouTube demo for examples and usage!
Please check out the project wiki for more in-depth detailed information about the file system itself, its API and its plugin modules!
Please check out the LeechCore project for information about supported memory acquisition methods and remote memory access via the LeechService.
To get going clone the sources in the repository or download the latest binaries, modules and configuration files from the releases section and check out the guide.
No matter if you have no prior knowledge of memory analysis or are an advanced user MemProcFS (and its API) may be useful! Click around the memory objects in the file system
Everything in MemProcFS is exposed as APIs. APIs exist for both C/C++ vmmdll.h
, C# vmmsharp.cs
, Java and Python memprocfs.py
. The file system itself is made available virtually via the API without the need to mount it. SIt is possible to read both virtual process memory as well as physical memory! The example below shows reading 0x20 bytes from physical address 0x1000:
>>> import memprocfs
>>> vmm = memprocfs.Vmm(['-device', 'c:/temp/win10_memdump.raw'])
>>> print(vmm.hex( vmm.memory.read(0x1000, 0x20) ))
0000 e9 4d 06 00 01 00 00 00 01 00 00 00 3f 00 18 10 .M..........?...
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Anyone is able to extend MemProcFS with custom plugins! It is as easy as dropping a python file in the correct directory or compiling a tiny C DLL. Existing functionality is already implemented as well documented C and Python plugins!
Get the latest binaries, modules and configuration files from the latest release. Alternatively clone the repository and build from source.
Mounting the file system requires the Dokany file system library to be installed. Please download and install the latest version of Dokany version 2 at: https://github.com/dokan-dev/dokany/releases/latest
Python support requires Python 3.6 or later. The user may specify the path to the Python installation with the command line parameter -pythonhome
, alternatively download Python 3.7 - Windows x86-64 embeddable zip file and unzip its contents into the files/python
folder when using Python modules in the file system. To use the Python API a normal 64-bit Python 3.6 or later installation for Windows is required.
To capture live memory (without PCILeech FPGA hardware) download DumpIt and start MemProcFS via DumpIt /LIVEKD mode. Alternatively, get WinPMEM by downloading the most recent signed WinPMEM driver and place it alongside MemProcFS - detailed instructions in the LeechCore Wiki.
PCILeech FPGA will require hardware as well as FTD3XX.dll to be dropped alongside the MemProcFS binaries. Please check out the LeechCore project for instructions.
MemProcFS is dependent on packages, please do a sudo apt-get install libusb-1.0 fuse openssl lz4
before trying out MemProcFS. If building from source please check out the guide about MemProcFS on Linux.
Start MemProcFS from the command line - possibly by using one of the examples below.
Or register the memory dump file extension with MemProcFS.exe so that the file system is automatically mounted when double-clicking on a memory dump file!
- mount the memory dump file as /home/pi/mnt/ on Linux:
./memprocfs -mount /home/pi/linux -device /dumps/win10x64-dump.raw
- mount the memory dump file as default M:
memprocfs.exe -device c:\temp\win10x64-dump.raw
- mount the memory dump file as default M: with extra verbosity:
memprocfs.exe -device c:\temp\win10x64-dump.raw -v
- mount the memory dump file as default M: with extra extra verbosity:
memprocfs.exe -device c:\temp\win10x64-dump.raw -v -vv
- mount the memory dump file as S:
memprocfs.exe -mount s -device c:\temp\win10x64-dump.raw
- mount live target memory, in verbose read-only mode, with DumpIt in /LIVEKD mode:
DumpIt.exe /LIVEKD /A memprocfs.exe /C "-v"
- mount live target memory, in read-only mode, with WinPMEM driver:
memprocfs.exe -device pmem
- mount live target memory, in read/write mode, with PCILeech FPGA memory acquisition device:
memprocfs.exe -device fpga -memmap auto
- mount a memory dump with a corresponding page files:
memprocfs.exe -device unknown-x64-dump.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys
For additional documentation please check out the project wiki for in-depth detailed information about the file system itself, its API and its plugin modules! For additional information about memory acqusition methods check out the LeechCore project
Also check out my Microsoft BlueHatIL 2019 talk Practical Uses for Hardware-assisted Memory Visualization and my Disobey 2020 talk Live Memory Attacks and Forensics about MemProcFS.
Pre-built binaries, modules and configuration files are found in the latest release.. MemProcFS binaries are built with Visual Studio 2022 and Ubuntu x64/AARCH64.
Detailed build instructions may be found in the Wiki in the Building section.
The project source code is released under: GNU Affero General Public License v3.0. Some bundled dependencies and plugins are released under GPLv3. Some bundled Microsoft redistributable binaries are released under separate licenses. Alternative closed-source licensing may be possible upon request.
PCILeech, MemProcFS and LeechCore are open source but not open contribution. PCILeech, MemProcFS and LeechCore offers a highly flexible plugin architecture that will allow for contributions in the form of plugins. If you wish to make a contribution, other than a plugin, to the core projects please contact me before starting to develop.
- Twitter:
- Discord:
- PCILeech: https://github.com/ufrisk/pcileech
- PCILeech FPGA: https://github.com/ufrisk/pcileech-fpga
- LeechCore: https://github.com/ufrisk/LeechCore
- MemProcFS: https://github.com/ufrisk/MemProcFS
- YouTube: https://www.youtube.com/channel/UC2aAi-gjqvKiC7s7Opzv9rg
- Blog: http://blog.frizk.net
- MemProcFSHunter: https://github.com/memprocfshunt/MemProcFSHunter
- MemProcFS-Analyzer: https://github.com/evild3ad/MemProcFS-Analyzer
PCILeech and MemProcFS is free and open source!
I put a lot of time and energy into PCILeech and MemProcFS and related research to make this happen. Some aspects of the projects relate to hardware and I put quite some money into my projects and related research. If you think PCILeech and/or MemProcFS are awesome tools and/or if you had a use for them it's now possible to contribute by becoming a sponsor!
If you like what I've created with PCIleech and MemProcFS with regards to DMA, Memory Analysis and Memory Forensics and would like to give something back to support future development please consider becoming a sponsor at: https://github.com/sponsors/ufrisk
To all my sponsors, Thank You 💖
All sponsorships are welcome, no matter how large or small. I especially wish to thank my bronze sponsors: grandprixgp.
Previous releases (click to expand):
v1.0
- Initial Release.
v1.1-v2.10
- Various updates. Please see individual relases for more information.
- Major release with new features, optimizations and refactorings.
- New virtual memory core for increased speed and memory recovery:
- VAD (virtual address descriptor) support.
- Win10 memory decompression bug-fixes.
- Pagefile support.
- Handles.
- Threads.
- API: new features and updates (module names from ansi to wide string).
- Bug fixes and refactorings.
- Code signing of binaries.
- New Features:
- Users.
- Volatile registry keys.
- File recovery via Handles and Vads.
- Bug fixes.
- Support for low-memory x64 systems.
- New Features:
- Certificates.
- Physical memory map.
- Per-page physical memory information (PFN database).
- Registry "big data" value type support.
- Bug fixes.
- Better write support.
- AMD Ryzen FPGA support.
- Module map: new info - Full .DLL Path.
- Thread map: new info - CPU registers.
- New forensic mode:
- Timelining.
- NTFS MFT parsing.
- SQLITE database generation.
- New Features:
- Minidump .DMP file generation for individual processes.
- Syscalls - nt & win32k.
- Bug fixes.
- Support for LiveCloudKd.
- Network UDP and TCP listen socket support.
- C# API and examples - located in
vmmsharp
project.
- Bug fixes.
- New Features:
- Minidump for live processes.
- Services information.
- Memmap: Verbose VAD with individual page info.
- Bug fixes & refactorings.
- NB! Breaking C/C++ API changes (function renames).
- New Features:
- Unloaded modules.
- FindEvil - find select signs of injections and malware.
- Updates & Improvements:
- Registry.
- Services.
- NTFS MFT.
- New Features:
- Time: process-time, boot-time, current-time, timezone.
- Python Light Plugins: print('file system plugins as easy as Python print!')
- Registry Parsing: usb-storage, bluetooth, wallpapers and more in 'py/reg' & 'py/by-user/reg'.
- Updates & Improvements:
- Rename 'sysinfo' directory to 'sys'.
- Better os detection (symbol fallback).
- Handles: additional object info.
- Info header in most info-files (enabled by default - possible to disable).
- New Features:
- Windows Kernel Object Manager Objects.
- Additional kernel driver information.
- Detailed Object and Object Header Info.
- Bug fixes.
- License Change: GNU Affero General Public License v3.0.
- Updates & Improvements:
- Faster and more robust parsing of physical memory map
- Rename per-process
user
totoken
and add more info.
- New Features:
- New Python API now also available on Python pip. Check out the YouTube demo!
py/reg/net/tcpip_interfaces.txt
- Bug fixes.
- New Features:
- Scheduled Tasks at
/sys/tasks/
- Forensic mode: JSON info file generation
/forensic/json/
(compatible with Elasticsearch).
- Scheduled Tasks at
- Linux support (x64 and aarch64).
- Separate releases for Windows and Linux.
- API Changes and some incompatibilities.
- Bug fixes.
- Offline kernel symbols (partial support). This allows for more functionality in Linux mode and in Windows offline mode.
- Support for VMWare live VM introspection.
- Support for remote agent-based memory analysis.
- Map kernel memory space into csrss.exe process (to make win32k easier to access).
- Support for Windows Server 2022.
- Support for Active Memory and Full Bitmap Microsoft Crash Dump files.
- 32-bit support for Windows and Linux (no 32-bit binary release yet).
Many thanks to @JosiahWhite for helping out getting me going and showing this was possible!
- Bug fixes: large modules no longer missing.
- Initial support for kernel pool parsing.
Thank you @yarden_shafir for the excellent BlackHat talk and PoolViewer tool. - Better network connection recovery.
- Merge memprocfs (Windows) and memprocfs_fuse (Linux) projects.
- New VMMDLL_Scatter_* API to simplify C/C++ ReadScatter use.
- Pool parsing bug fixes.
- New ReadScatter API for Python.
- VMMDLL_Scatter_* API efficiency improvements for some smaller reads.
- Visual Studio 2022 Support.
- Upgrade to Dokany2 (NB! Dokany2 will have to be installed!).
- New memory search functionality (file system and API).
- New/improved logging sub-system.
- Minor API updates.
- Bug fixes.
- New WriteScatter API.
- Process environment variables.
- C# support for New Scatter API and Search API.
- Forensic file consistency when analyzing local file with -forensic start-up option.
- Search updates.
- Bitlocker key recovery.
- Bug fixes.
- Python and C# API updates.
- Additional FindEvil detection vectors.
- Process child/parent parsing improvements.
- Process integrity levels and full SID list.
- Heap parsing.
- Web history plugin.
Latest:
- Bug fixes.
- Java API.
- Additional info in token/sid-all.txt.
- ElasticSearch authentication for JSON import added.