Suggestion: Parsing from shared memory ?

[rchateauneu]

Just a idea.

At the moment Haystack parses a memory dump in a file.

Maybe it would be great, to map a process memory, and then directly parse it without an intermediary file.

For example on linux we could use /proc/$pid/maps : http://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux

On Windows, with the function ReadProcessMemory(): http://stackoverflow.com/questions/19606159/c-reading-memory-of-another-process

This would also give the possibility to scan a process memory while it is running without blocking it, which would indeed yield imprecise results if the data are being modified, but this might be enough (At least in my case)

[trolldbois]

Good idea. Should be quite simple. One of the issue is that some protected memory segments will not be accessible. A solution is code injection. I think that Frida-re could help in that aspect.

[trolldbois]

https://github.com/nowsecure/frida-memory-stream