Assists with memory analysis and forensics using MemProcFS. Use when analyzing memory dumps, investigating system activity, or performing forensic examinations.
MemProcFS Agent Skill is an agent skill designed for Claude Code to enhance its capabilities in memory analysis and digital forensics. This skill integrates Claude with the powerful MemProcFS tool, enabling users to perform deep memory dump analysis, live memory investigation, and forensic workflows.
MemProcFS is an open-source tool that provides a convenient way to view physical memory as files in a virtual file system. It supports various memory acquisition methods, including memory dump files, live memory (via WinPMEM or DumpIt), virtual machine memory, and remote memory acquisition (via LeechAgent).
memprocfs-analysis/ ├── SKILL.md # Skill metadata and main instructions ├── forensic-workflows.md # Guides for common forensic workflows ├── python-api-guide.md # Detailed guide for Python API usage ├── filesystem-reference.md # Reference for virtual file system structure ├── examples.md # Practical code examples and use cases ├── troubleshooting.md # Common issues and solutions └── scripts/ # Directory for optional helper scripts
Copy the \memprocfs-analysis\ directory to the Claude Code Skill directory:
On Windows:
C:\Users\<YourUsername>\.claude\skills\memprocfs-analysis\
On Linux/macOS:
~/.claude/skills/memprocfs-analysis/
Download the latest version from the MemProcFS GitHub Releases page based on your operating system.
Windows:
Linux: `ash sudo apt-get install libusb-1.0 fuse
`
macOS:
If you plan to use the Python API for automated analysis:
ash pip install memprocfs
Use \memprocfs.exe\ to load the memory dump file and mount it as a virtual file system:
Basic Command Format:
ash memprocfs.exe -device <memory_image_path> -forensic 1
Examples: `ash
memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1
memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1 -mount M: `
Parameter Explanation:
After Loading:
Once the memory image is successfully loaded, you can access the mounted virtual file system for forensic analysis:
M:\ # Virtual file system root ├── proc\ # Process information directory ├── sys\ # System information directory │ ├── sysinfo.txt # Basic system information │ └── net\ # Network connection information ├── forensic\ # Forensic analysis modules │ ├── findevil\ # Malware detection │ ├── timeline\ # Event timeline │ └── yara\ # YARA scan results └── registry\ # Registry information
You can read these directories and files just like accessing normal files to perform memory forensic analysis.
Exit and restart Claude Code to load the new Skill.
In Claude Code, you can start the Skill in the following ways:
"Analyze the memory dump file located at /path/to/memory.dmp"
"Conduct a forensic investigation on this memory image"
"Use MemProcFS to identify malware in this memory dump"
| Document | Purpose | |----------|---------| | forensic-workflows.md | Structured workflows for common forensic tasks | | python-api-guide.md | Complete guide for MemProcFS Python API | | filesystem-reference.md | Reference for virtual file system structure and modules | | examples.md | Practical code examples and usage scenarios | | troubleshooting.md | Common issues and solutions |
If the Skill does not trigger or you encounter errors, please refer to troubleshooting.md for detailed solutions.
MemProcFS is released under the GNU Affero General Public License v3.0. This Skill is supplementary documentation for MemProcFS.
For issues or suggestions, please visit MemProcFS GitHub Issues or join the PCILeech/MemProcFS Discord Community.
Edit PDFs with natural-language instructions using the nano-pdf CLI.
Control Sonos speakers (discover/status/play/volume/group).
Terminal Spotify playback/search via spogo (preferred) or spotify_player.
Capture frames or clips from RTSP/ONVIF cameras.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
Category:tools