#physical-memory #memory #memflow #introspection #winapi

memflow-coredump

win32 coredump connector for the memflow physical memory introspection framework

5 unstable releases

0.2.0-beta7 Jul 24, 2022
0.2.0-beta3 Mar 18, 2022
0.2.0-beta11 Dec 17, 2023
0.1.1 Sep 6, 2020
0.0.0 Sep 1, 2020

#787 in Operating systems

MIT license

27KB
508 lines

memflow-coredump

The coredump connector implements the Microsoft Windows Coredump format for 32-bit and 64-bit Coredump files. It implements support for full core dumps (type 1) and partial bit mapped core dumps (type 5).

Compilation

Installing the library

The recommended way to install memflow connectors is using memflowup.

Development builds

To compile the connector as dynamic library to be used with the memflow plugin system use the following command:

cargo build --release --all-features

The plugin can then be found in the target/release/ directory and has to be copied to one of memflows default search paths.

Linking the crate statically in a rust project

To use the connector in a rust project just include it in your Cargo.toml

memflow-coredump = "^0.2.0-beta"

Arguments

The target argument specifies the filename of the coredump file to be opened.

License

Licensed under MIT License, see LICENSE.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, shall be licensed as above, without any additional terms or conditions.

Dependencies

~7.5MB
~133K SLoC