ufrisk/MemProcFS

Health v2 · maintenance only

Adoption not part of the score

4300 stars · 519 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

MemProcFS is an memory forensic tool that exposes physical memory, memory dump files, and live memory acquisition sources as files in a virtual file system. It also provides a rich application library (with Python bindings) for programmatic memory analysis and supports remote live incident response via the LeechAgent acquisition agent.

Use cases

• analyze memory dump files as a mounted file system
• perform live memory incident response on a remote machine
• inspect processes and modules from live memory with point-and-click tools
• read and write virtual machine memory from VMware or LiveCloudKd
• acquire memory via PCILeech FPGA hardware
• script memory analysis in Python or PowerShell
• feed memory contents into hex editors, debuggers, or disassemblers

When to choose

• you need to analyze Windows memory dumps or live memory without complex command-line arguments
• you want to use familiar file-based tools (hex editors, scripts, debuggers) on memory
• you need remote live memory acquisition over low-bandwidth connections
• you want programmatic access to memory artifacts via an API for your own tooling

When to avoid

• you need memory forensics for non-Windows target operating systems with limited support
• you only need simple one-off memory dumps rather than interactive analysis
• you require a purely GUI-based forensic suite with report generation
• hardware-based acquisition via PCILeech FPGA is out of your budget or scope

Facets

library · maturity active

file-system security developer-tools security reverse-engineering developer-tools operating-systems windows python cpp cli memory-forensics virtual-file-system incident-response memory-analysis pcileech live-memory memory-dump forensics linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ufrisk/MemProcFS")