python-haystack
python-haystack copied to clipboard
Process heap analysis framework - Windows/Linux - record type inference and forensics
When running this script on Windows 7: import haystack from haystack import memory_dumper memory_dumper.dump(123,"toto.dmp") ... I get this error: dumper.make_mappings() File "C:\Python27\lib\site-packages\haystack-0.34-py2.7.egg\haystack\memory_dumper.py", line 41, in make_mappings self.dbg = dbg.get_debugger(self._pid) File...
- Port to QT5 - Soft requirement of QT in package dependency, - transform main memory view with an Hilbert curve space representation https://en.wikipedia.org/wiki/Hilbert_curve#Applications_and_mapping_algorithms
So that it "integrates" nicely with rekall/volatility. But that would mean migrating all the ctypes code to vtypes. not sure. ctypes are clearly lighter and technically more portable ?.
http://cerbero-blog.com/?p=1586
potentially we would be able to reset the ProcessContext and its model whereas we probably don't want to touch the internal model used for heapwalker. there should probably be a...
https://github.com/vivisect/vivisect