Writeups for stuxnet99's MemLabs — a series of CTF-style memory forensics challenges. I'm working through these to build a practical understanding of memory forensics techniques and tooling.
Memory forensics is one of those areas where reading about it only gets you so far. MemLabs provides hands-on scenarios with real memory dumps, which forces you to actually work through the analysis process rather than just follow theory. The CTF format also makes it easier to know when you're on the right track and I personalyl find it fun.
- Volatility 2 (
vol2) — primary analysis framework. - GIMP — reconstructing raw pixel data from process memory dumps
- Standard Unix utilities —
xxd,base64,grep, etc.
| Lab | Title | Status | Flags |
|---|---|---|---|
| Lab 1 | Beginner's Luck | Complete | 3 / 3 |
| Lab 2 | A New World | Complete | 3 / 3 |
| Lab 3 | The Evil Twin | Complete | 1 / 1 |
| Lab 4 | Obsession | Complete | 1 / 1 |
| Lab 5 | Black Tuesday | Complete | 3 / 3 |
| Lab 6 | The Reckoning | Complete | 1 / 1 |
Each lab lives in its own directory containing a writeup markdown file and an images/ folder with screenshots taken during analysis.