MemTools

Windows, Linux DMA, Dump, Direct, inject memory tool

• DirectMemoryTools reads local memory
• DmaMemoryTools reads DMA memory, only supports DMA reading of Windows memory
• DumpMemoryTools reads dumped memory
• InjectMemoryTools reads memory through injection
• MemoryToolsBase is the base class for the above memory tools, all of which inherit from it

Compilation

• Windows Compilation environment: Clion + cmake + vs2022. In Clion's cmake configuration, select the vs2022 compilation toolchain for compilation.
• Linux Compilation environment: Clion + cmake + Unix Makefiles. In Clion's cmake configuration, select the Unix Makefiles compilation tool.
• Note:
  On Linux, you also need to copy the three library files [vmm.so] [leechcore.so] [leechcore_ft601_driver_linux.so] to /usr/lib64/ and execute with root privileges

Test environment

Windows

• Windows 11 + vs2022

Linux

• Linux arm64 Orange Pi 5 + Ubuntu 20.04
• Linux X64 to be developed....

How to use dumped memory

Use the CEDumpPlugin plugin below together with CE for analysis

About

• pcileech (DMA driver)
• DMALibrary (DMA tool code)
• CEDumpPlugin (CE Dump memory analysis plugin)