Crate memf_linux 

Linux kernel memory forensic walkers.

Provides process, network connection, and kernel module enumeration by walking kernel data structures in physical memory dumps.

Re-exports

pub use types::*;

Modules

arp

Linux ARP cache extraction from the kernel neighbour table.

bash

Linux bash command history recovery.

bash_history

Bash command history extraction from memory byte slices.

boot_time

Linux boot time extraction from kernel timekeeper.

bpf

Linux eBPF program enumeration from kernel memory.

capabilities

Linux process capabilities analysis for privilege escalation detection.

cgroups

Linux cgroup membership enumeration for container forensics.

check_afinfo

Linux network protocol handler (seq_afinfo) hook detector.

check_creds

Shared credential structure detection for privilege escalation analysis.

check_fops

Linux file_operations table hook detector.

check_hooks

Linux kernel inline hook detector.

check_idt

Linux IDT (Interrupt Descriptor Table) hook detector.

check_modules

Linux hidden kernel module detector.

cmdline

Linux process command line walker.

container_escape

Container escape artifact detection.

correlate

IntoForensicEvents implementations for Linux walker output types.

cpu_pinning

CPU affinity / cryptominer detection via scheduling policy and CPU pinning.

crontab

Linux crontab entry recovery from cron process memory.

deleted_exe

Detect processes running from deleted executables.

dentry_cache

Detect files hidden via dentry unlink (open-but-unlinked file descriptors).

dmesg

Linux kernel dmesg ring buffer extraction.

ebpf_progs

eBPF map enumeration from kernel memory.

elf_analysis

ELF dynamic symbol analysis for LD_PRELOAD rootkit detection.

elfinfo

Linux ELF header extraction from process memory.

envvars

Linux process environment variable walker.

files

Linux open file descriptor walker.

framebuffer

Linux EFI/VESA linear framebuffer recovery — locates the framebuffer via boot_params.screen_info and encodes the captured screen as PNG.

fs

Linux mounted filesystem walker.

ftrace

Ftrace hook detection from kernel memory.

fuse_abuse

FUSE filesystem abuse detection.

futex_forensics

Futex forensics for Linux memory forensics.

heuristics

Pure heuristic classifiers for Linux forensic artifacts.

io_uring

Linux io_uring context forensics.

iomem

I/O memory resource region enumeration.

ipc

Linux System V IPC object enumeration.

kaslr

KASLR offset detection for Linux kernels.

kernel_timers

Linux kernel timer enumeration for rootkit callback detection.

keyboard_notifiers

Keyboard notifier chain forensics — keylogger detection.

kmsg

Kernel message ring buffer extraction.

kthread

Linux kernel thread enumeration and anomaly detection.

ld_preload

LD_PRELOAD injection detection for Linux memory forensics.

library_list

Process shared library enumeration for Linux memory forensics.

magic_gid

Magic GID detection — identifies processes controlled by LD_PRELOAD rootkits.

malfind

Linux suspicious memory region detector (malfind).

maps

Linux process memory map (VMA) walker.

memfd_create

Detect fileless payloads loaded via memfd_create(2).

modules

Linux kernel module walker.

modxview

Cross-view kernel module detection for Linux.

mountinfo

Mount namespace forensics — enumerate mounts from kernel memory.

namespaces

Linux namespace enumeration for container forensics.

netfilter

Linux netfilter (iptables) rule extraction from kernel memory.

netlink_audit

Audit rule suppression / netlink audit tamper detection.

network

Linux network connection walker.

oom_events

OOM (Out-of-Memory) kill event recovery from the kernel log buffer.

pam_hooks

PAM library hook detection.

perf_event

Suspicious perf_event detection for Linux memory forensics.

preload_scanner

Library prevalence analysis for LD_PRELOAD rootkit detection.

proc_cmdline

Pure-logic process command-line parsing and forensic classification.

proc_hidden

Hidden process detection via PID namespace vs task list discrepancy.

process

Linux process walker.

psaux

Detailed process information extraction (Linux ps aux equivalent).

psxview

Linux hidden process detection via cross-view analysis.

ptrace

Linux ptrace relationship detection for debugging/injection analysis.

raw_sockets

Detect processes holding raw (AF_PACKET or SOCK_RAW) sockets.

seccomp

Linux seccomp-BPF filter analysis for container security forensics.

shared_mem_anomaly

Shared memory forensics / anomaly detection.

signal_handlers

Linux process signal handler inspection for malware detection.

ssh_keys

SSH key extraction from sshd process memory.

syscalls

Linux syscall table integrity checker.

systemd_units

In-memory systemd unit analysis.

thread

Linux thread walker.

timerfd_signalfd

Timer/signal FD abuse detection.

tmpfs_recovery

Tmpfs/ramfs inode enumeration for ephemeral file recovery.

tty_check

Linux TTY operations hook detector.

types

Output types for Linux forensic walkers.

unix_sockets

Linux Unix domain socket walker.

user_ns_escalation

User namespace escalation detection.

vdso_tamper

vDSO tampering detection.

vma_walker

VMA region walker — shared abstraction for Linux walkers.

zombie_orphan

Zombie and orphan process detection for Linux memory forensics.

Enums

Error

Error type for memf-linux operations.

Traits

WalkerPlugin

A plugin that walks Linux kernel data structures.

Type Aliases

Result

A Result alias for memf-linux.