FS_Root.md · pelin0963/MemProcFS.wiki - Gitee.com

加入 Gitee

与超过 1200万开发者一起发现、参与优秀开源项目，私有仓库也完全免费：）

该仓库未声明开源许可证文件（LICENSE），使用请关注具体项目描述及其代码上游依赖。

克隆/下载

FS_Root.md 2.61 KB

## The `root` directory

The root directory of the Memory Process File System contains multiple directories and files which contains the physical memory of the target.

#### Directories:
The files in the **root** directory are listed in the table below:
| Directory                                                        | Description                                        |
| ---------------------------------------------------------------- | -------------------------------------------------- |
| [conf](https://github.com/ufrisk/MemProcFS/wiki/FS_Conf)         | Configuration and Status.                          |
| [forensic](https://github.com/ufrisk/MemProcFS/wiki/FS_Forensic) | Forensic mode.                                     |
| [misc](https://github.com/ufrisk/MemProcFS/wiki/FS_Misc)         | Miscellaneous functionality                        |
| name                                                             | Per-process directories listed by process name.    |
| pid                                                              | Per-process directories listed by process pid.     |
| py                                                               | Python based plugins.                              |
| [registry](https://github.com/ufrisk/MemProcFS/wiki/FS_Registry) | Registry information.                              |
| [sys](https://github.com/ufrisk/MemProcFS/wiki/FS_SysInfo)       | System information.                                |
| [vm](https://github.com/ufrisk/MemProcFS/wiki/VM)                | Virtual Machine (VM) information.                  |

#### Files:

The files in the **root** directory are listed in the table below:
| File              | Description                                                             |
| ----------------- | ----------------------------------------------------------------------- |
| memory.dmp        | The physical memory slightly adjusted to conform with the Microsoft crash dump format and WinDbg. |
| memory.pmem       | The raw physical memory.                                                |

The files are writable if a write-capable memory acquisition device is used.

### Example

The example below shows hex editing of the _memory.pmem_ file which reflects the physical memory of the target being analyzed. In this example the low stub is being analyzed and the kernel page table base (PML4) is marked at address 0x10a0.

Also shown is WinDbg accessing the auto-generated _memory.dmp_ WinDbg compatible full crash dump file.

[[resources/root_root_2.png]]

### For Developers
It is possible to add sub-directories if registering general/root functionality in native plugins.

一键复制编辑原始数据按行查看历史

提交于 2023-05-08 22:17 . Guide Update

The `root` directory

The root directory of the Memory Process File System contains multiple directories and files which contains the physical memory of the target.

Directories:

The files in the root directory are listed in the table below:

Directory	Description
conf	Configuration and Status.
forensic	Forensic mode.
misc	Miscellaneous functionality
name	Per-process directories listed by process name.
pid	Per-process directories listed by process pid.
py	Python based plugins.
registry	Registry information.
sys	System information.
vm	Virtual Machine (VM) information.

Files:

The files in the root directory are listed in the table below:

File	Description
memory.dmp	The physical memory slightly adjusted to conform with the Microsoft crash dump format and WinDbg.
memory.pmem	The raw physical memory.

The files are writable if a write-capable memory acquisition device is used.

Example

The example below shows hex editing of the memory.pmem file which reflects the physical memory of the target being analyzed. In this example the low stub is being analyzed and the kernel page table base (PML4) is marked at address 0x10a0.

Also shown is WinDbg accessing the auto-generated memory.dmp WinDbg compatible full crash dump file.

[[resources/root_root_2.png]]

For Developers

It is possible to add sub-directories if registering general/root functionality in native plugins.

1

https://gitee.com/pelin0963/MemProcFS-wiki.git

git@gitee.com:pelin0963/MemProcFS-wiki.git

pelin0963

MemProcFS-wiki

MemProcFS.wiki

master