memflow/memflow

Health v2 · maintenance only

Adoption not part of the score

1087 stars · 98 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

memflow is a Rust library providing a modular framework for physical memory introspection of machines, including live hardware, virtual machines, and memory dumps. It chains pluggable connectors and OS abstraction layers to expose process-level memory access with a fast virtual address translation pipeline and C ABI bindings for non-Rust consumers.

Use cases

• introspect physical memory of a running machine
• read process memory from a virtual machine from the host
• analyze memory dumps for forensics
• build DMA-based debugging tools
• enumerate processes inside a live Windows VM
• access memory across nested virtualization layers

When to choose

• you need a generic, composable interface to physical or virtual memory across machines and dumps
• you want dynamically loadable connectors and OS layers with C FFI bindings
• you need high-throughput virtual address translation for scanning large address spaces

When to avoid

• you only need simple userspace process debugging on your own OS
• you need a ready-made GUI forensic tool rather than a library
• your target OS layer is not yet implemented in the ecosystem

Facets

library · maturity active

security reverse-engineering sdk developer-tools security reverse-engineering operating-systems developer-tools rust windows cross-platform cpp memory-forensics dma introspection virtualization ffi memory-dump-analysis linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="memflow/memflow")