python-haystack memory forensics

Quick Start:

You might want to look into the base libary python-haystack.

Run haystack-gui

Introduction:

python-haystack is an heap analysis framework, focused on searching and reversing of C structure in allocated memory.

this is an attempt at a GUI.

This is not working right now

Dump the process, then you can open it in the GUI::

$ haystack-gui # ( and Ctrl-O , click click)
$ haystack-gui --dumpname dumps/myssh.dump

You can the search a structure from the heap of that memory mapping.

You have to import your extensions before that to have them listed in the search dialog.

Dependencies :

• python-haystack
• PyQt