volafox

Introduction

volafox a.k.a 'Memory Analyzer for Mac OS X' is developed on python 2.x

System Environment

Lang: Python 2.x
Arch: Intel x86/64(0.7 alpha1<=)
Requirement

• Kernel Symbol List
• overlay data (0.7 alpha1<=)

• Memory Image
• Linear File Format(Firewire or VMware memory image, flatten MMR) (0.7 alpha1<=)
• Mac Memory Reader Format(32bit) (svn version)

Information

1. Machine Information
   
2. Mounted Filesystem
   
3. Process List
   
4. KEXT information
   
5. System Call List
   
6. Detecting System Call Hooking
   
7. KEXT Dump(0.6 beta1 fixed1<=)
   
8. Process Dump (0.6 beta1<=)
   
9. Network Information (0.7 alpha1<=)
10. Open file list (svn v52<=)

volafunx(experimental version)

Introduction

Memory Analyzer for FreeBSD
Tested OS: FreeBSD x86 7.x, 8.x
Requirement

• Kernel Image(kernel)
• Memory Image

1. KLD list
2. KLD dump
3. System call hooking detection
4. Process list(LIST, HASH) (0.2 beta2<=)
5. Process dump (HASH)
6. Network Information (IP, Port, flag) (0.2 beta2<=)
7. Module list in KLD (0.2 beta1<=)
   

icon source : www.kaishinlab.com