How do I use MemProcFS to write custom rules to retrieve memory based on a particular string or sequence of bytes? about memprocfs HOT 5 CLOSED

If you're thinking about the virtual memory file / virtual memory space; yes it's going to be too large. It's huge.

There is no way to retrieve memory based on a specific signature. You'll have to read memory and scan the contents of it using your own code.

One way to approach this may be to retrieve the active memory segments in virtual memory - the VADs. This can be retrieved with the call to VmmPy_ProcessGetVadMap.

When you know what the addresses and sizes and a little about what the memory is related to you may read that using VmmPy_MemRead or VmmPy_MemReadScatter

from memprocfs.

Way way long over due. I have some time ago added a search capability to MemProcFS to the file system and its C/C++ API.

If there is any interest I could port it over to Python as well.

I'm closing this issue since it's now finally implemented.

from memprocfs.

Hi, ufrisk. Have you ported the VMMDLL_MemSearch and VMMDLL_YaraSearch functions to Python?

from memprocfs.

@FlameSky-S It's not added currently. I'll look into adding it next week when I'm back home.

from memprocfs.

@FlameSky-S This was added in the most recent MemProcFS update (v5.7). Please let me know how it works for you.

There are some examples in the example file and also documentation in the wiki

from memprocfs.