ufrisk/MemProcFS

MemProcFS:

MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or via a feature rich application library to include in your own projects!

Analyze memory dump files, live memory via DumpIt or WinPMEM, live memory in read-write mode from virtual machines or from PCILeech FPGA hardware devices!

It's even possible to connect to a remote LeechAgent memory acquisition agent over a secured connection - allowing for remote live memory incident response - even over higher latency low band-width connections! Peek into Virtual Machines with MemProcFS, LiveCloudKd or VMware!

Use your favorite tools to analyze memory - use your favorite hex editors, your python and powershell scripts, WinDbg or your favorite disassemblers and debuggers - all will work trivally with MemProcFS by just reading and writing files!

Get Started!

Check out the excellent quick walkthrough from 13Cubed to get going! Also check out my older conference talks from Disobey and BlueHat.

For additional documentation check out the project wiki for in-depth detailed information about the file system itself, its API and its plugin modules! For additional information about memory acqusition methods check out the LeechCore project or hop into the PCILeech/MemProcFS Discord server!

To get going download the latest binaries, modules and configuration files and check out the guide!

Installing:

Get the latest binaries, modules and configuration files from the latest release. Alternatively clone the repository and build from source.

Windows

Mounting the file system requires the Dokany file system library to be installed. Download and install the latest version of Dokany version 2 at: https://github.com/dokan-dev/dokany/releases/latest

To capture live memory (without PCILeech FPGA hardware) download DumpIt and start MemProcFS via DumpIt /LIVEKD mode. Alternatively, get WinPMEM by downloading the most recent signed WinPMEM driver and place it alongside MemProcFS - detailed instructions in the LeechCore Wiki.

PCILeech FPGA will require hardware as well as FTD3XXWU.dll to be dropped alongside the MemProcFS binaries. Please check out the LeechCore project for instructions.

Linux

MemProcFS should be possible to run out-of-the-box on most Linux distros with FUSE installed. If building from source check out the guide about MemProcFS on Linux.

macOS

Download the latest MemProcFS release from here. MemProcFS when used as a mounted virtual file system depends on macFuse which requires a .kext. Download and install macFuse here. If MemProcFS is used via the supported C/C++/Rust APIs macFuse is not required.

Extensive Python, Rust, Java, Go, C# and C/C++ API:

Include MemProcFS in your C/C++, C#, Java, Go (3rd party), Python or Rust programming projects! Everything in MemProcFS is exposed via an easy-to-use API for use in your own projects! The Plugin friendly architecture allows users to easily extend MemProcFS with C/C++/Rust/Python plugins!

Everything in MemProcFS is exposed as APIs. APIs exist for both C/C++ vmmdll.h, C# nuget package, Java, Python pip package and Rust crate. The file system itself is made available virtually via the API without the need to mount it. It is possible to read both virtual process memory as well as physical memory! The example below shows reading 0x20 bytes from physical address 0x1000:

>>> import memprocfs
>>> vmm = memprocfs.Vmm(['-device', 'c:/temp/win10_memdump.raw'])
>>> print(vmm.hex( vmm.memory.read(0x1000, 0x20) ))
0000    e9 4d 06 00 01 00 00 00  01 00 00 00 3f 00 18 10   .M..........?...
0010    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

MemProcFS is available as a Python pip package and it's easy to integrate in your Jupyter Notebooks.

Examples:

Start MemProcFS from the command line - possibly by using one of the examples below.

Or register the memory dump file extension with MemProcFS.exe so that the file system is automatically mounted when double-clicking on a memory dump file!

• mount the memory dump file as default M:
  memprocfs.exe -device c:\temp\win10x64-dump.raw
• mount the memory dump file as default M: with extra verbosity:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -v
• mount the memory dump file as default M: and start forensics mode:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1
• mount the memory dump file as default M: and start forensics mode with a yara scan:
  memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1 -forensic-yara-rules c:\yara\rules\windows_malware_index.yar
• mount the memory dump file as /home/pi/mnt/ on Linux:
  ./memprocfs -mount /home/pi/linux -device /dumps/win10x64-dump.raw
• mount the memory dump file as S:
  memprocfs.exe -mount s -device c:\temp\win10x64-dump.raw
• mount live target memory, in read-only mode, with WinPMEM driver:
  memprocfs.exe -device pmem
• mount live target memory, in read/write mode, with PCILeech FPGA memory acquisition device:
  memprocfs.exe -device fpga -memmap auto
• mount a memory dump with a corresponding page files:
  memprocfs.exe -device unknown-x64-dump.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys

PCILeech and MemProcFS community:

Find all this a bit overwhelming? Or just want to ask a quick question? Join the PCILeech and MemProcFS DMA community server at Discord!

Building:

Pre-built binaries, modules and configuration files are found in the latest release.. MemProcFS binaries are built with Visual Studio 2022 and Ubuntu x64/AARCH64.

Detailed build instructions may be found in the Wiki in the Building section.

License:

The project source code is released under: GNU Affero General Public License v3.0. Some bundled dependencies and plugins are released under GPLv3. Some bundled Microsoft redistributable binaries are released under separate licenses. Alternative licensing may be possible upon request.

Contributing:

PCILeech, MemProcFS and LeechCore are open source but not open contribution. PCILeech, MemProcFS and LeechCore offers a highly flexible plugin architecture that will allow for contributions in the form of plugins. If you wish to make a contribution, other than a plugin, to the core projects please contact me before starting to develop.

Links:

• Twitter:
• Discord:
• PCILeech: https://github.com/ufrisk/pcileech
• PCILeech FPGA: https://github.com/ufrisk/pcileech-fpga
• LeechCore: https://github.com/ufrisk/LeechCore
• MemProcFS: https://github.com/ufrisk/MemProcFS
• Blog: http://blog.frizk.net

Links - Related Projects:

• MemProcFS-Analyzer is a 3rd party PowerShell application used for simplifying the usage of MemProcFS and to optimize your memory analysis workflow. MemProcFS-Analyzer is maintained by @evild3ad at LETHAL-FORENSICS.

Changelog:

v5.16

• Bug fixes.
• Support for Windows 11 25H2

v5.17

• Support for Windows 11 26H1.
• Improved registry parsing.
• New refresh options in the API.
• New optional logging callback in the API.
• Support for non-ascii characters in file paths.

v5.18

• Bug fixes.
• New module: Windows Terminal parser (Win11+).
• New forensic module: amcache parser (Win10+).
• PTE map upper limit adjusted from 65536 to 131072.
• Fix: File writes in WSL mounted MemProcFS (drvfs) now works.

Latest:

• Bug fixes.
• Fix: Heap recovery now works on Windows 11 24H2 and later.
• Fix: Pool and Heap parsing improved.
• Fix: Compressed memory recovery rates improved.