volatility
An advanced memory forensics framework (by volatilityfoundation)
ps_mem
A utility to accurately report the in core memory usage for a program (by pixelb)
Our great sponsors
| volatility | ps_mem | |
|---|---|---|
| 18 | 6 | |
| 6,928 | 1,507 | |
| 1.6% | - | |
| 0.0 | 0.0 | |
| 11 months ago | over 1 year ago | |
| Python | Python | |
| GNU General Public License v3.0 only | GNU Lesser General Public License v3.0 only |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
volatility
Posts with mentions or reviews of volatility.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-05-28.
-
What is the appropriate uncompressed kernel ELF to use with dwarf2json? [ 5.19.0-42-generic #43~22.04.1-Ubuntu ], in order to create generate a custom symbols table to conduct linux memory forensics on Ubuntu 22.04?
I need this to create generate a custom symbols table (using dwarf2json), in order to run a memory dump acquired by Ubuntu 22.04, as Ubuntu 22.04 kernel does not work anymore with volatility 2 (Issue here: volatilityfoundation/volatility#828)
-
volatility memory analysis ep.8 – linux/mac Q!
Take a look at this link and specifically note how the profiles are named, especially Ubuntu - https://github.com/volatilityfoundation/volatility/wiki/Linux-Command-Reference
-
Dump file without a extension
I think the typical tool for analyzing OS memory dumps is Volatility but I can't give you a course in how to use it, that is supposedly what your school should be doing.
- memory dump with FTK Imager
-
How to inspect a Linux machine
Analyzing memory dumps can be hard, especially at the beginning. You might want to use comprehensive Frameworks like volatility.
-
Does anyone know why volatility isnt working?
git clone https://github.com/volatilityfoundation/volatility.git whenever i want to run something I get PS C:\Users\czare_000\python-course-for-beginners\bs4\volatility> & C:/Users/czare_000/AppData/Local/Programs/Python/Python310/python.exe c:/Users/czare_000/python-course-for-beginners/bs4/volatility/volatility/debug.py Traceback (most recent call last): File "c:\Users\czare_000\python-course-for-beginners\bs4\volatility\volatility\debug.py", line 27, in import volatility.conf ModuleNotFoundError: No module named 'volatility' or i also get except Exception, e: ^^^^^^^^^^^^ SyntaxError: multiple exception types must be parenthesized
-
Analyzing raw image
Volatility is python based so you will need to install it and volatility's required dependencies. You can find the install instructions here https://github.com/volatilityfoundation/volatility
-
PChunter equivalent on Linux?
volatility - Version 2 Version 3
- How do you work on memory analysis nowadays? Discussion about the Volatility status.
-
RAM Memory Analysis volatility
The volatility wiki should have instructions you need. Just follow the steps here (https://github.com/volatilityfoundation/volatility/wiki/Linux#making-the-profile)
ps_mem
Posts with mentions or reviews of ps_mem.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-06-16.
-
Why is it using that much ram? Is that a trojan? Is that a feature of the linux-tkg kernel? (nothing else is running in the background)
I use a script I call memtop10.sh that uses a combination of ps and ps_mem.py which you can find here: https://github.com/pixelb/ps_mem/blob/master/ps_mem.py
-
PSA: the way the “free” command calculates unused memory changed significantly between Bullseye and Bookworm
Do you mean something like this: https://github.com/pixelb/ps_mem
-
Some of my computer's RAM "disappears" over time. Where does it go?
ps_mem https://github.com/pixelb/ps_mem
-
Tauri 1.0 – Electron Alternative Powered by Rust
Just as a reference, the application I'm building features a lot things inside the final binary, that might affect ram usage, so this is not a "hello-world" example but a real application, with a SPA built-into the binary and loaded into RAM, together with a HTTP API and more (fuller list here: https://news.ycombinator.com/item?id=31765186).
With that said, `ps_mem` (https://github.com/pixelb/ps_mem) reports that the memory usage is 58.7 MiB after starting the Tauri application. If I run just the HTTP API, memory usage ends up being 19.4 MiB. So I guess in that sense, the overhead of Tauri is about ~39.3 MiB.
-
Memory Available Unaccounted For
I'm not sure if it's still working since I've not used it for a while but you can get accurate reports with ps_mem
- Measuring memory usage: virtual versus real memory
What are some alternatives?
When comparing volatility and ps_mem you can also consider the following projects:
shellbags - Cross-platform, open-source shellbag parser
TempOSD - On Screen Display for cpu and gpu temperatures, ram and swap usages statistics.
binwalk - Firmware Analysis Tool [Moved to: https://github.com/ReFirmLabs/binwalk]
awesome-tauri - 🚀 Awesome Tauri Apps, Plugins and Resources
volatility3 - Volatility 3.0 development
psutil - Cross-platform lib for process and system monitoring in Python
MalConfScan - Volatility plugin for extracts configuration data of known malware
tauri - Build smaller, faster, and more secure desktop applications with a web frontend.
picoCTF - The platform used to run picoCTF 2019.
mold - Mold: A Modern Linker 🦠
radare2 - UNIX-like reverse engineering framework and command-line toolset [Moved to: https://github.com/radareorg/radare2]
one_gadget - The best tool for finding one gadget RCE in libc.so.6