<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Malware Memory Forensics — API Reference

## Volatility 3

### Installation

```bash
pip install volatility3
vol3 --help
```

### Core Plugins

```bash
# System info
vol3 -f memory.dmp windows.info
vol3 -f memory.dmp banners

# Process analysis
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.psscan
vol3 -f memory.dmp windows.pstree
vol3 -f memory.dmp windows.cmdline

# Code injection detection
vol3 -f memory.dmp windows.malfind
vol3 -f memory.dmp windows.malfind --dump --pid <PID>
vol3 -f memory.dmp windows.vadinfo --pid <PID>

# Module analysis
vol3 -f memory.dmp windows.dlllist --pid <PID>
vol3 -f memory.dmp windows.modules
vol3 -f memory.dmp windows.modscan
vol3 -f memory.dmp windows.driverscan

# Network
vol3 -f memory.dmp windows.netscan

# Handles and registry
vol3 -f memory.dmp windows.handles --pid <PID>
vol3 -f memory.dmp windows.registry.hivelist
vol3 -f memory.dmp windows.registry.printkey --key "Software\\Microsoft\\Windows\\CurrentVersion\\Run"

# YARA scanning
vol3 -f memory.dmp yarascan.YaraScan --yara-file rules.yar
vol3 -f memory.dmp yarascan.YaraScan --yara-file rules.yar --pid <PID>
vol3 -f memory.dmp yarascan.YaraScan --yara-file rules.yar --kernel

# Kernel analysis
vol3 -f memory.dmp windows.ssdt
vol3 -f memory.dmp windows.callbacks
```

### Output Formats

```bash
vol3 -f memory.dmp windows.pslist --output csv > output.csv
vol3 -f memory.dmp windows.pslist --output json > output.json
vol3 -f memory.dmp windows.pslist --output pretty
```

## Memory Acquisition Tools

### WinPmem

```bash
winpmem_mini_x64.exe output.raw              # Raw format
winpmem_mini_x64.exe output.aff4             # AFF4 format
winpmem_mini_x64.exe --format raw output.raw # Explicit format
```

### LiME (Linux)

```bash
# Build for current kernel
cd LiME/src && make
sudo insmod lime-$(uname -r).ko "path=/tmp/mem.lime format=lime"
sudo insmod lime-$(uname -r).ko "path=/tmp/mem.raw format=raw"
```

### DumpIt

```bash
DumpIt.exe                    # Interactive — dumps to current directory
DumpIt.exe /OUTPUT mem.raw   # Specify output path
```

## Linux Memory Analysis

```bash
vol3 -f memory.lime linux.pslist
vol3 -f memory.lime linux.pstree
vol3 -f memory.lime linux.lsmod
vol3 -f memory.lime linux.hidden_modules
vol3 -f memory.lime linux.check_syscall
vol3 -f memory.lime linux.check_idt
vol3 -f memory.lime linux.proc_maps --pid <PID>
vol3 -f memory.lime linux.bash    # Bash history from memory
```
