volatility
An advanced memory forensics framework (by volatilityfoundation)
gef
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux (by hugsy)
| volatility | gef | |
|---|---|---|
| 18 | 15 | |
| 6,964 | 6,538 | |
| 1.5% | - | |
| 0.0 | 8.4 | |
| 12 months ago | 7 days ago | |
| Python | Python | |
| GNU General Public License v3.0 only | MIT License |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
volatility
Posts with mentions or reviews of volatility.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-05-28.
-
What is the appropriate uncompressed kernel ELF to use with dwarf2json? [ 5.19.0-42-generic #43~22.04.1-Ubuntu ], in order to create generate a custom symbols table to conduct linux memory forensics on Ubuntu 22.04?
I need this to create generate a custom symbols table (using dwarf2json), in order to run a memory dump acquired by Ubuntu 22.04, as Ubuntu 22.04 kernel does not work anymore with volatility 2 (Issue here: volatilityfoundation/volatility#828)
-
volatility memory analysis ep.8 – linux/mac Q!
Take a look at this link and specifically note how the profiles are named, especially Ubuntu - https://github.com/volatilityfoundation/volatility/wiki/Linux-Command-Reference
-
Dump file without a extension
I think the typical tool for analyzing OS memory dumps is Volatility but I can't give you a course in how to use it, that is supposedly what your school should be doing.
- memory dump with FTK Imager
-
How to inspect a Linux machine
Analyzing memory dumps can be hard, especially at the beginning. You might want to use comprehensive Frameworks like volatility.
-
Does anyone know why volatility isnt working?
git clone https://github.com/volatilityfoundation/volatility.git whenever i want to run something I get PS C:\Users\czare_000\python-course-for-beginners\bs4\volatility> & C:/Users/czare_000/AppData/Local/Programs/Python/Python310/python.exe c:/Users/czare_000/python-course-for-beginners/bs4/volatility/volatility/debug.py Traceback (most recent call last): File "c:\Users\czare_000\python-course-for-beginners\bs4\volatility\volatility\debug.py", line 27, in import volatility.conf ModuleNotFoundError: No module named 'volatility' or i also get except Exception, e: ^^^^^^^^^^^^ SyntaxError: multiple exception types must be parenthesized
-
Analyzing raw image
Volatility is python based so you will need to install it and volatility's required dependencies. You can find the install instructions here https://github.com/volatilityfoundation/volatility
-
PChunter equivalent on Linux?
volatility - Version 2 Version 3
- How do you work on memory analysis nowadays? Discussion about the Volatility status.
-
RAM Memory Analysis volatility
The volatility wiki should have instructions you need. Just follow the steps here (https://github.com/volatilityfoundation/volatility/wiki/Linux#making-the-profile)
gef
Posts with mentions or reviews of gef.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-11-05.
-
Beej's Quick Guide to GDB (2009)
There is also GEF, which is widely used by the reverse engineering and CTF community.
https://github.com/hugsy/gef
-
How do you use gdb without the tui? Are there advantages? Or just describe your GDB workflow.
If you are on Linux, install GEF and be happy.
- TF2 on Linux is running incredibly poorly, reporting 1200%+ CPU usage. Steam also appears to have some sort of memleak and infinite loop/callback going on leading to absurd CPU usage over time.
-
Any good and easy-to-use C debuggers?
If you are in linux, I recomend none of them (haha) because you should get more used to GDB a little bit. You just need to install some good visualizers likes GEF, for example.
- Emulating an emulator inside itself. Meet Blink
-
Are there any cpu emulators that could help me learn i386 assembly?
https://github.com/hugsy/gef, https://hugsy.github.io/gef/, https://hugsy.github.io/gef/commands/context/ ("Values in red indicate that this register has had its value changed since the last time execution stopped.")
- What plugins do you recommend for ExploitDev or RE and why?
- Awesome TUI tools
-
Fully Dockerized Linux kernel debugging environment
The attached debugger is not just raw GDB but is using https://hugsy.github.io/gef/ to make debugging less of a pain. It's still not perfect but helps plenty already.
-
Debugging with GDB
I still struggle with GDB but my excuse is that I seldom use it.
When I was studying reverse engineering though, I came across a really cool kit (which I've yet to find an alternative for lldb, which would be nice given: rust)
I'd recommend checking it out, if for no other reason than it makes a lot of things really obvious (like watching what value lives in which register).
https://github.com/hugsy/gef
LLDB's closest alternative to this is called Venom, but it's not the same at all. https://github.com/ovh/venom
What are some alternatives?
When comparing volatility and gef you can also consider the following projects:
shellbags - Cross-platform, open-source shellbag parser
pwndbg - Exploit Development and Reverse Engineering with GDB Made Easy
binwalk - Firmware Analysis Tool [Moved to: https://github.com/ReFirmLabs/binwalk]
peda - PEDA - Python Exploit Development Assistance for GDB
volatility3 - Volatility 3.0 development
gdb-dashboard - Modular visual interface for GDB in Python
MalConfScan - Volatility plugin for extracts configuration data of known malware
lldb-mi - LLDB's machine interface driver
picoCTF - The platform used to run picoCTF 2019.
radare2 - UNIX-like reverse engineering framework and command-line toolset [Moved to: https://github.com/radareorg/radare2]
edb-debugger - edb is a cross-platform AArch32/x86/x86-64 debugger.