skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-mem-forensics

Analyze memory dumps with Volatility 3 to extract processes, network connections, injected code, and credential artifacts.

64|9|Updated Aug 17, 2026
Search Tags:#incident response#malware analysis#memory forensics#credential extraction#volatility 3#memory dump analysis#code injection detection
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-mem-forensics-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-mem-forensics
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-mem-forensics
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-mem-forensics-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires volatility3, pycryptodome, yara-python.

What problem does it solve? Investigators holding a raw memory image (.raw/.mem/.core) need a repeatable way to reconstruct what was running on a compromised machine—processes, network connections, injected code, and credential traces—without executing the sample or trusting the live system. ## Core Features & Use Cases - Process and network reconstruction: Enumerate processes (pslist/psscan/pstree), command lines, services, and network connections (netscan) from Windows, Linux, and macOS dumps, including terminated or hidden processes. - Injection and anomaly detection: Detect code injection, process hollowing, ETW/AMSI patching, and sleep-obfuscated payloads using malfind, hollowprocesses, etwpatch, and VAD analysis, then dump suspicious regions for static analysis. - Credential and evidence extraction: Pull registry-hive-derived credentials (hashdump/lsadump/cachedump), scan with YARA rules, extract file objects, and build CSV event timelines for forensic reports. - Use Case: During incident response you receive a Windows memory dump from an infected host. Use this Skill to list processes, find an anomalous svchost with an outbound C2 connection, dump the injected memory region, and archive every artifact with sha256 hashes for the evidence report. ## Quick Start Analyze the memory dump 'infected-host.raw' with Volatility 3 to list processes, find network connections, detect injected code, and extract any credential artifacts.

Frequently Asked Questions about re-mem-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a memory dump with Volatility 3?▼

Run vol -f dump.raw windows.info to confirm the image, then enumerate processes with windows.pslist and windows.psscan, check connections with windows.netscan, and detect injection with windows.malfind. Linux and macOS dumps use the linux.* and mac.* plugin prefixes instead.

How to fix Volatility 3 missing symbol errors?▼

Missing symbol errors mean the ISF symbol table does not match the target. For Windows, Volatility downloads PDBs from the Microsoft symbol server automatically; for Linux and macOS, run the banners plugin to get the kernel banner, then find a prebuilt ISF or build one with dwarf2json or btf2json.

Can Volatility 3 analyze Linux and macOS memory dumps?▼

Yes, Volatility 3 supports Linux and macOS dumps through linux.* and mac.* plugins, but symbols are not downloaded automatically. You must match an ISF file to the exact kernel banner, either from community prebuilt packs or by building one with dwarf2json or btf2json.

Why is malfind reporting false positive injections?▼

malfind flags any executable private memory pages, so legitimate RWX regions from JIT compilers, loaders, and garbage collectors also match. Cross-confirm with dlllist module paths, hollowprocesses results, and static analysis of the dumped region before concluding injection.

Why are hashdump or yarascan plugins missing from vol --help?▼

Credential plugins (hashdump, lsadump, cachedump) require pycryptodome and yarascan requires yara-python; without them the plugins silently fail to load. Install both with pip install pycryptodome yara-python and rerun vol --help to confirm.

When should I not use Volatility for memory analysis?▼

Volatility only parses full-machine memory images, not single-process dumps like gcore ELF cores, which need gdb or eu-stack instead. It also cannot analyze a live system interactively; use a debugger such as GDB or x64dbg for live debugging.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

analyzing-linux-kernel-rootkits

Detect Linux kernel rootkits in memory dumps using Volatility3 plugins and cross-view analysis.

Community
Intermediate
wgpsecwgpsec
1.7k

malware-analysis-methodology

Analyze suspicious PE, ELF, and Mach-O binaries through static, dynamic, and IOC extraction workflows.

Official
Advanced
SherifEldeebSherifEldeeb
5

timeline-forensics

Aggregate disk, memory, log, PCAP, and registry artifacts into forensic timelines.

Community
Advanced
bingookbingook

memory-forensics-volatility

Analyze memory dumps with Volatility 2 and 3 for malware detection.

Community
Advanced