JEjeffmcjunkin·May 18, 2020
Exactly this. Much like the Volatility Framework's psscan[1] module.
[1] https://github.com/volatilityfoundation/volatility/wiki/Comm...
In How to Use Trend Micro's Rootkit Remover to Install a Rootkitvolatilityfoundation
volatility
Python2014–2020
volatilityfoundation / volatility · Archived
volatility
An advanced memory forensics framework
7Distinct people
7Mentions
0Explicit recommenders
8.1KGitHub stars
What to know before exploring
What it is
An advanced memory forensics framework
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year7 dated mentions
Observed mentions: 2014-12-16 19:13:21 UTC to 2020-05-18 18:44:44 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 3 | 1 | 2 |
What Hacker News says
7 sourcesVolatility, An advanced memory forensics framework
1 points · Open discussionThere is a tool used in malware analysis and computer forensics called Volatility[0]. It has some very powerful analysis tools and works on Linux Mac and Windows. In your case its ability to dump the memory of a running process without messing with the process state [1] may be very helpful! It also has the ability to run a Yara scan against the dumped memory which could let you find the region of memory containing the config file (so long as you know some of the strings in it).
Hope this helps!
[0] https://github.com/volatilityfoundation/volatility
[1] https://www.andreafortuna.org/2017/07/10/volatility-my-own-c...
In Ask HN: Ever worked with a service that can never be restarted?This is a hard space to break into because it requires in depth knowledge of operating systems. I'd play around with volatility https://github.com/volatilityfoundation/volatility.
Next take a look at getting good with IDA, it's expensive but they have freeware versions you can use, it just won't do x64.
Start by specializing in only one OS, pick linux/mac/windows. It's a very niche space and requires a lot of expertise if you want it as a job.
If you're thinking long term I'd take a look at becoming a malware analyst as it will also help you pick up skills needed to go down the path you'd like.
In Ask HN: How to get into low level system security?As long as this functionality is documented on the incognito start page, similar to "doesn't make you anonymous" warnings, it seems fine (by design) to me.
If anyone has any pointers to documentation on the forensics aspects of this I'd appreciate a link.
It doesn't look like there's that much open source available for the new-ish Windows 8+ hibernation file: https://github.com/volatilityfoundation/volatility/issues/25
In iCloud was storing cleared browsing historiesIf you can dump the VMs "physical memory" - even from an AWS VM, e.g. using the LiME kernel module (https://github.com/volatilityfoundation/volatility/wiki/Lime...) you can still use Volatility and I believe libvmi as well to get some details about what's happening and I don't think it would be possible to disable this technique. Also, this shouldn't interfere with any other guests on the same metal.
In LibVMI: virtual machine introspectionVolatility: an advanced memory forensics framework
1 points · Open discussion