Home

The LeechCore and LeechAgent Wiki and Guide

Welcome to the Wiki and Guide for the LeechCore library and the LeechAgent remote memory acquisition and analysis agent! In addition to this guide please check out the project README for general information.

For individual guide items please have a look at the sidebar to the right.

The LeechCore library is a physical memory acquisition library used by other applications such as PCILeech and MemProcFS. The LeechCore library exists for Windows as a .dll and for Linux as a .so. Some features such as the remote connection capability as well as the DumpIt/WinPMEM/Hyper-V Saved State functionality only exists in the Windows version of the library - while other functionality such as File/USB3380/FPGA/iLO exists in both versions of the library.

The LeechCore library does not exist as a stand-alone component. The LeechCore is only meant to be included in other applications. The supported devices and their connection options are however documented in this wiki.

The LeechAgent Remote Acquisition and Analysis Agent:

A separate LeechAgent application exists for Windows.

The LeechAgent service exposes the LeechCore library API via a remote RPC connection secured by mutually authenticated Kerberos (if running in an Active Directory environment). It is also possible to optionally run the LeechAgent in an insecure unauthenticated mode.

Start the LeechAgent in either interactive mode or in service mode to allow for remote users of the LeechCore library to connect to the LeechAgent and use any of the supported memory acquisition methods transparently and remotely.

Components using the LeechCore library - such as The Memory Process File System is working fairly well even over low-bandwidth high-latency (up to 100ms).

Submit remote memory analysis jobs to the LeechAgent; in the form of python scripts using the MemProcFS API to the remote LeechAgent for processing. This is ideal for complicated processing intense tasks, or tasks that should run on a large number of hosts in parallel. This approach works extremely well even over low-bandwidth high-latency connections.

Memory Acquisition Methods:

Software based memory acquisition methods:

Please find a summary of the supported software based memory acquisition methods listed below. Please note that the LeechAgent only provides a network connection to a remote LeechCore library. It's possible to use both hardware and software based memory acquisition once connected.

Device	Type	Volatile	Write	Linux Support
RAW physical memory dump	File	No	No	Yes
Full Microsoft Crash Dump	File	No	No	Yes
Full ELF Core Dump	File	No	No	Yes
VMware memory save file	File	No	No	Yes
Hyper-V Saved State	File	No	No	No
TotalMeltdown	CVE-2018-1038	Yes	Yes	No
DumpIt /LIVEKD	Live Memory	Yes	No	No
WinPMEM	Live Memory	Yes	No	No
LeechAgent*	Remote			No

Hardware based memory acquisition methods:

Please find a summary of the supported hardware based memory acquisition methods listed below. All hardware based memory acquisition methods are supported on both Windows and Linux. The FPGA based methods however sports a slight performance penalty on Linux and will max out at approx: 90MB/s compared to 150MB/s on Windows.

Device	Type	Interface	Speed	64-bit memory access	PCIe TLP access
AC701/FT601	FPGA	USB3	150MB/s	Yes	Yes
PCIeScreamer	FPGA	USB3	100MB/s	Yes	Yes
SP605/FT601	FPGA	USB3	75MB/s	Yes	Yes
SP605/TCP	FPGA	TCP/IP	100kB/s	Yes	Yes
NeTV2/UDP	FPGA	UDP/IP	7MB/s	Yes	Yes
USB3380-EVB	USB3380	USB3	150MB/s	No	No
PP3380	USB3380	USB3	150MB/s	No	No
DMA patched HP iLO	BMC	TCP/IP	1MB/s	Yes	No