Skip to content

A small memory-forensics learning tool that can parse raw and crash dumps to walk the active process list of Windows 7 32 bits

License

Notifications You must be signed in to change notification settings

bconstanzo/nemo

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 

Repository files navigation

nemo

A simple tool to begin working in forensic memory analysis, from zero to a working pslist().

Code should be simple and asy to follow. Not particularly awesome code though.

Works in Python 3.6+.

Note

This code has been shown and worked upon in/for the Memory Forensics Workshop of InFo-Conf 2018, Mar del Plata, Argentina.

Special thanks to Gonzalo for helping me build it from scratch.

About

A small memory-forensics learning tool that can parse raw and crash dumps to walk the active process list of Windows 7 32 bits

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages