<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Memory Forensics Triage — API Reference

## Volatility 3 Core Commands

### Process Enumeration

```bash
# Linked list traversal (shows running processes)
vol.py -f mem.raw windows.pslist

# Pool tag scanning (finds hidden/terminated processes)
vol.py -f mem.raw windows.psscan

# Process command-line arguments
vol.py -f mem.raw windows.cmdline

# Process environment variables
vol.py -f mem.raw windows.envars --pid $PID
```

### Code Injection Detection

```bash
# Find injected code (RWX pages without file backing)
vol.py -f mem.raw windows.malfind

# Dump injected regions to disk
vol.py -f mem.raw windows.malfind --dump --pid $PID -o /evidence/dumps/

# List loaded DLLs per process
vol.py -f mem.raw windows.dlllist --pid $PID
```

### Network Forensics

```bash
# Active and recent network connections
vol.py -f mem.raw windows.netscan

# Filter for established connections
vol.py -f mem.raw windows.netscan | grep ESTABLISHED
```

### Credential Extraction

```bash
# SAM database hashes
vol.py -f mem.raw windows.hashdump

# LSA secrets
vol.py -f mem.raw windows.lsadump
```

### Kernel Analysis

```bash
# Loaded kernel modules
vol.py -f mem.raw windows.modules

# SSDT hooks (rootkit detection)
vol.py -f mem.raw windows.ssdt

# Driver objects
vol.py -f mem.raw windows.driverscan
```

## Memory Acquisition APIs

### WinPmem (Windows)

```powershell
# Basic acquisition
winpmem_mini_x64.exe C:\evidence\mem.raw

# With page file
winpmem_mini_x64.exe --format raw C:\evidence\mem.raw
```

### AVML (Linux)

```bash
# Acquire to file
avml /evidence/mem.lime

# Acquire compressed
avml --compress /evidence/mem.lime.gz
```

### LiME (Linux Kernel Module)

```bash
# Build for current kernel
cd LiME/src && make

# Acquire in lime format
insmod lime.ko "path=/evidence/mem.lime format=lime"

# Acquire in padded format (Volatility-compatible)
insmod lime.ko "path=/evidence/mem.padded format=padded"
```

## YARA Integration

### Scanning Memory Dumps

```bash
# Scan dumped regions with YARA rules
yara -r /rules/malware.yar /evidence/dumps/

# Volatility YARA plugin (scan full memory)
vol.py -f mem.raw yarascan --yara-file /rules/malware.yar
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `-f` | Memory image file path | `mem.raw` |
| `--pid` | Filter by process ID | `1234` |
| `--dump` | Dump matched regions to disk | N/A |
| `-o` | Output directory for dumps | `/evidence/dumps/` |
| `--yara-file` | YARA rules file for scanning | `/rules/apt.yar` |
| `format` | LiME acquisition format | `lime`, `padded`, `raw` |

## Common Analysis Patterns

### Hidden Process Detection

```
pslist PIDs (linked) vs psscan PIDs (pool scan)
→ PIDs in psscan but NOT in pslist = hidden/unlinked processes
→ Indicates DKOM rootkit or process hollowing
```

### Injection Heuristics

```
malfind flags:
- Protection: PAGE_EXECUTE_READWRITE
- No mapped file (VAD tag: VadS not VadF)
- MZ header in non-image VAD = reflective DLL injection
- Shellcode patterns: NOP sleds, API hashing stubs
```
