Skip to content

README.md

Latest commit

 

History

History
19 lines (14 loc) · 1.08 KB

README.md

File metadata and controls

19 lines (14 loc) · 1.08 KB
Raw

Linux Live Process Memory Extractor

A lightweight incident response and memory forensics CLI tool written in Python. It inspects running processes on Linux systems by directly parsing virtual memory layouts in /proc/[pid]/maps and extracting live memory artifacts from /proc/[pid]/mem without requiring external kernel drivers or heavy third-party dependencies.

Key Features

  • Virtual Memory Mapping: Parses /proc/[pid]/maps to locate readable memory regions (heap, stack, anonymous mappings, shared libraries).
  • Direct Memory Inspection: Seeks and reads process memory buffers directly via /proc/[pid]/mem.
  • Artifact Extraction: Filters and extracts printable ASCII strings, in-memory tokens, system paths, and environmental variables.
  • Safety Bounds: Automatically skips massive virtual memory allocations (>10MB) to preserve responsiveness during live analysis.

Prerequisites

  • Linux OS (Native, WSL2, VM)
  • Python 3.x
  • Root/sudo privileges (required to read /proc/[pid]/mem across process boundaries)

Usage

sudo ./mem_extract.py <PID> [options]