Skip to content

Commit

Permalink
feat: updated organisation section paths
Browse files Browse the repository at this point in the history
  • Loading branch information
theo-abel committed Apr 23, 2024
1 parent c10387f commit 6afb7b0
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,11 @@ $ direnv allow .

## Organisation

- `architectures/` : various architectures parsers and a generic one
- `qemu/` : contains scripts and patch necessary to get ground truth registers values from an emulated system
- `mmushell.py` : main script allowing to reconstruct virtual address spaces from a memory dump, more instructions below
- `mmushell/architectures/` : various architectures parsers and a generic one
- `mmushell/mmushell.py` : main script allowing to reconstruct virtual address spaces from a memory dump, more instructions below
- `mmushell/exporter.py` : this is a POC showing the possible use of techniques to perform a preliminary analysis of a dump by exporting each virtual address space as a self-contained ELF Core dump file. See section [TOWARDS OS AGNOSTIC MEMORY FORENSICS](https://www.s3.eurecom.fr/docs/tops22_oliveri.pdf).
- `converter.py` : export dump to be used in [Fossil](https://github.com/eurecom-s3/fossil). It adds CPU registers and convert the kernel physical address space in virtual address space one. **Note**: you can ignore this script, is not part of mmushell
- `exporter.py` : this is a POC showing the possible use of techniques to perform a preliminary analysis of a dump by exporting each virtual address space as a self-contained ELF Core dump file. See section [TOWARDS OS AGNOSTIC MEMORY FORENSICS](https://www.s3.eurecom.fr/docs/tops22_oliveri.pdf).
- `qemu/` : contains scripts and patch necessary to get ground truth registers values from an emulated system

## Usage

Expand Down

0 comments on commit 6afb7b0

Please sign in to comment.