-
-
Notifications
You must be signed in to change notification settings - Fork 94
Device_Existing
The Existing memory acquisition device type is a pseudo type. Sometimes there a need to attach to an already existing LeechCore instance.
An example is a program with an already initialized LeechCore via MemProcFS. To get the LeechCore handle it's possible to specify -device existing.
The existing device type may also be used in conjunction with the LeechAgent to attach to already on-going sessions.
LeechCore API:
Please specify the acquisition device type in LC_CONFIG.szDevice when calling LcCreate. The acquisition device type is existing.
PCILeech / MemProcFS:
Please specify the device type in the -device option to PCIleech/MemProcFS.
Examples:
-device existing
No additional requirements exist.
Sponsor PCILeech and MemProcFS:
PCILeech and MemProcFS is free and open source!
I put a lot of time and energy into PCILeech and MemProcFS and related research to make this happen. Some aspects of the projects relate to hardware and I put quite some money into my projects and related research. If you think PCILeech and/or MemProcFS are awesome tools and/or if you had a use for them it's now possible to contribute by becoming a sponsor!
If you like what I've created with PCIleech and MemProcFS with regards to DMA, Memory Analysis and Memory Forensics and would like to give something back to support future development please consider becoming a sponsor at: https://github.com/sponsors/ufrisk
Thank You 💖