Forensics

Recent mquire releases add views for the questions that come up first when triaging a Linux memory dump: injected code, dynamic-linker hijacks, unexpected capabilities, processes under a tracer, and kernel hooks that belong to no module. This post shows each one with real output. [Read More]

Linux 7.0 changed the way kallsyms is stored in the kernel image, and mquire reads that data to rebuild the symbol table from a memory dump. This post describes the three changes I had to make to support it: the new PC-relative symbol offsets, and two smaller problems caused by the section alignment going from eight bytes to four. [Read More]

mquire is a Linux memory forensics tool that can analyze kernel memory snapshots without relying on external debug symbols, by using BTF type data and kallsyms information already embedded inside the kernel itself. [Read More]