-
-
Notifications
You must be signed in to change notification settings - Fork 393
API_Rust
Most functionality in the Memory Process File System is made available in a easy-to-use convenient Rust API for the use by developers. The Rust API is a wrapper around the native C/C++ API with some extras.
The MemProcFS Rust API is published as the memprocfs crate at crates.io - which makes it very easy to include in your memory analysis projects!
Check out the API documentation at docs.rs.
Check out the example project and the example MemProcFS plugin.
// Initialize MemProcFS on Linux targeting a live Windows system
// by reading memory using a PCILeech PCIe FPGA hardware device.
// After initialization list all processes.
let mut args = ["-printf", "-device", "fpga"].to_vec();
let vmm = Vmm::new("/home/user/memprocfs/vmm.so", &args)?
if let Ok(process_all) = vmm.process_list() {
for process in &*process_all {
println!("{} : {}", process.pid, process.info()?.name);
}
}
// Initialize MemProcFS on Windows - analyzing a memory dump file.
// Also trigger the forensic mode and scan for VMs.
// List all processes in the virtual file system directory /name/.
let mut args = ["-printf", "-forensic", "1", "-vm",
"-device", "C:\\dumps\\memory.dmp"].to_vec();
let vmm = Vmm::new("C:\\MemProcFS\\vmm.dll", &args)?
if let Ok(vfs_all) = vmm.vfs_list("/name/") {
println!("Number of files/directories: {}.", vfs_all.len());
for vfs in &*vfs_all {
println!("{vfs}");
}
}
Sponsor PCILeech and MemProcFS:
PCILeech and MemProcFS is free and open source!
I put a lot of time and energy into PCILeech and MemProcFS and related research to make this happen. Some aspects of the projects relate to hardware and I put quite some money into my projects and related research. If you think PCILeech and/or MemProcFS are awesome tools and/or if you had a use for them it's now possible to contribute by becoming a sponsor!
If you like what I've created with PCIleech and MemProcFS with regards to DMA, Memory Analysis and Memory Forensics and would like to give something back to support future development please consider becoming a sponsor at: https://github.com/sponsors/ufrisk
Thank You 💖