Linux Live Process Memory Extractor

A lightweight incident response and memory forensics CLI tool written in Python. It inspects running processes on Linux systems by directly parsing virtual memory layouts in /proc/[pid]/maps and extracting live memory artifacts from /proc/[pid]/mem without requiring external kernel drivers or heavy third-party dependencies.

Key Features

• Virtual Memory Mapping: Parses /proc/[pid]/maps to locate readable memory regions (heap, stack, anonymous mappings, shared libraries).
• Direct Memory Inspection: Seeks and reads process memory buffers directly via /proc/[pid]/mem.
• Artifact Extraction: Filters and extracts printable ASCII strings, in-memory tokens, system paths, and environmental variables.
• Safety Bounds: Automatically skips massive virtual memory allocations (>10MB) to preserve responsiveness during live analysis.

Prerequisites

• Linux OS (Native, WSL2, VM)
• Python 3.x
• Root/sudo privileges (required to read /proc/[pid]/mem across process boundaries)

Usage

sudo ./mem_extract.py <PID> [options]