Ulf Frisk

"In this talk, we will explain and demo state-of-the-art memory visualization and analysis. This method highlights a different perspective on the internals of a running system and was used to find the ""Total Meltdown"" vulnerability. We'll showcase the Memory Process File System, which is a different way of visualizing in-memory Windows internals as files in a file system. It brings an easy, yet powerful, point and click interface for memory analysis of processes and in-memory objects, along with an extensive C and Python API. Analyze memory dumps or even live memory acquired from local or remote systems by a wide range of memory acquisition methods - including PCIe DMA hardware devices. In addition to explaining the framework and setup, the presentation will revolve heavily among live demos - showing various uses for the Memory Process File System."