The Memory Process File System:
The Memory Process File System (MemProcFS) is an easy and convenient way of accessing physical memory as files a virtual file system.
Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or via a feature rich application library to include in your own projects!
Analyze memory dump files, live memory via DumpIt or WinPMEM, live memory in read-write mode via linked PCILeech and PCILeech-FPGA devices!
It's even possible to connect to a remote LeechAgent memory acquisition agent over a secured connection - allowing for remote live memory incident response - even over higher latency low band-width connections!
Use your favorite tools to analyze memory - use your favorite hex editors, your python and powershell scripts, WinDbg or your favorite disassemblers and debuggers - all will work trivally with MemProcFS by just reading and writing files!
Include MemProcFS in your Python or C/C++ programming projects! Everything in MemProcFS is exposed via an easy-to-use API for use in your own projects! The Plugin friendly architecture allows users to easily extend MemProcFS with native C .DLL plugins or Python .py plugins - providing additional analysis capabilities!
Please check out the project wiki for more in-depth detailed information about the file system itself, its API and its plugin modules!
Please check out the LeechCore project for information about supported memory acquisition methods and remote memory access via the LeechService.
To get going clone the sources in the repository or download the latest binaries, modules and configuration files from the releases section and check out the guide.
Fast and easy memory analysis via mounted file system:
No matter if you have no prior knowledge of memory analysis or are an advanced user MemProcFS (and its API) may be useful! Click around the memory objects in the file system
Extensive Python and C/C++ API:
Everything in MemProcFS is exposed as APIs. APIs exist for both C/C++ vmmdll.h and Python vmmpy.py. The file system itself is made available virtually via the API without the need to mount it. Specialized process analysis and process alteration functionality is made easy by calling API functionality. It is possible to read both virtual process memory as well as physical memory! The example below shows reading 0x20 bytes from physical address 0x1000:
>>> from vmmpy import *
>>> VmmPy_Initialize('c:/temp/win10_memdump.raw')
>>> print(VmmPy_UtilFillHexAscii(VmmPy_MemRead(-1, 0x1000, 0x20)))
0000 e9 4d 06 00 01 00 00 00 01 00 00 00 3f 00 18 10 .M..........?...
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Modular Plugin Architecture:
Anyone is able to extend MemProcFS with custom plugins! It is as easy as dropping a python file in the correct directory or compiling a tiny C DLL. Existing functionality is already implemented as well documented C and Python plugins!
Installing:
Windows
Get the latest binaries, modules and configuration files from the latest release. Alternatively clone the repository and build from source.
MemProcFS is dependent on the LeechCore project for memory acquisition. The necessary leechcore.dll file is already pre-built and included together with the pre-built binaries.
MemProcFS is also dependent in the Microsoft Visual C++ Redistributables for Visual Studio 2019. They can be downloaded from Microsoft here. Alternatively, if installing the Dokany file system driver please install the DokanSetup_redist version and it will install the required redistributables.
Mounting the file system requires the Dokany file system library to be installed. Please download and install the latest version of Dokany at: https://github.com/dokan-dev/dokany/releases/latest It is recommended to download and install the DokanSetup_redist version.
Python support requires Python 3.6 or later. The user may specify the path to the Python installation with the command line parameter -pythonhome, alternatively download Python 3.7 - Windows x86-64 embeddable zip file and unzip its contents into the files/python folder when using Python modules in the file system. To use the Python API a normal 64-bit Python 3.6 or later installation for Windows is required.
To capture live memory (without PCILeech FPGA hardware) download DumpIt and start MemProcFS via DumpIt /LIVEKD mode. Alternatively, get WinPMEM by downloading the most recent signed WinPMEM driver and place it alongside MemProcFS - detailed instructions in the LeechCore Wiki.
PCILeech FPGA will require hardware as well as FTD3XX.dll to be dropped alongside the MemProcFS binaries. Please check out the LeechCore project for instructions.
Linux
The memory process file system is only supported on Windows.
Examples:
Start MemProcFS from the command line - possibly by using one of the examples below.
Or register the memory dump file extension with MemProcFS.exe so that the file system is automatically mounted when double-clicking on a memory dump file!
- mount the memory dump file as default M:
memprocfs.exe -device c:\temp\win10x64-dump.raw - mount the memory dump file as default M: with extra verbosity:
memprocfs.exe -device c:\temp\win10x64-dump.raw -v - mount the memory dump file as default M: with extra extra verbosity:
memprocfs.exe -device c:\temp\win10x64-dump.raw -v -vv - mount the memory dump file as S:
memprocfs.exe -mount s -device c:\temp\win10x64-dump.raw - mount live target memory, in verbose read-only mode, with DumpIt in /LIVEKD mode:
DumpIt.exe /LIVEKD /A memprocfs.exe /C "-v" - mount live target memory, in read-only mode, with WinPMEM driver:
memprocfs.exe -device pmem - mount live target memory, in read/write mode, with PCILeech FPGA memory acquisition device:
memprocfs.exe -device fpga - mount live target memory, in read/write mode, with TotalMeltdown vulnerability acquisition device:
memprocfs.exe -device totalmeltdown - mount a memory dump with a corresponding page files:
memprocfs.exe -device unknown-x64-dump.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys
Documentation:
For additional documentation please check out the project wiki for in-depth detailed information about the file system itself, its API and its plugin modules! For additional information about memory acqusition methods check out the LeechCore project
Also check out my Microsoft BlueHatIL 2019 talk Practical Uses for Hardware-assisted Memory Visualization about MemProcFS at Youtube below:
Building:
Pre-built binaries, modules and configuration files are found in the latest release.. MemProcFS binaries are built with Visual Studio. MemProcFS is not supported on Linux.
Detailed build instructions may be found in the Wiki in the Building section.
Current Limitations & Future Development:
MemProcFS is currently limited to analyzing Windows (32-bit and 64-bit XP to 10) memory dumps.
Please find some ideas for possible future expansions of the memory process file system listed below. This is a list of ideas - not a list of features that will be implemented. Even though some items are put as prioritized there is no guarantee that they will be implemented in a timely fashion.
Prioritized items:
- More/new plugins.
Other items:
- Hash lookup of executable memory pages in DB.
- Additional file recovery.
- PFN support.
License:
The project source code is released under GPLv3. Some bundled Microsoft redistributable binaries are released under separate licenses.
Links:
- Blog: http://blog.frizk.net
- Twitter: https://twitter.com/UlfFrisk
- PCILeech: https://github.com/ufrisk/pcileech/
- LeechCore: https://github.com/ufrisk/LeechCore/
- YouTube: https://www.youtube.com/channel/UC2aAi-gjqvKiC7s7Opzv9rg
Changelog:
v1.0
- Initial Release.
v1.1-v2.10
- Various updates. Please see individual relases for more information.
- Major release with new features, optimizations and refactorings.
- New virtual memory core for increased speed and memory recovery:
- VAD (virtual address descriptor) support.
- Win10 memory decompression bug-fixes.
- Pagefile support.
- Handles.
- Threads.
- API: new features and updates (module names from ansi to wide string).
- Bug fixes and refactorings.
- Code signing of binaries.
- New Features:
- Users.
- Volatile registry keys.
- File recovery via Handles and Vads.
- Bug fixes.
- Support for low-memory x64 systems.
- New Features:
- Certificates.
- Physical memory map.
- Per-page physical memory information (PFN database).
- Registry "big data" value type support.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent