memf-core 0.1.0

Virtual address translation and kernel object reading for memory forensics
Documentation

Virtual address translation and kernel object reading.

This crate provides:

  • [VirtualAddressSpace] — page table walking for x86_64 (4-level, 5-level), AArch64, and x86 PAE/non-PAE modes
  • [ObjectReader] — high-level kernel struct traversal using symbol information