dismember - :knife: Scan memory for secrets and more. Maybe ev

项目说明

:hocho: Dismember

Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes (or particular ones) for common secrets and custom regular expressions, among other things.

It will e become a full /proc toolkit.

!A gif showing dismember finding credentials from the memory of a browser

Using the grep command, it can match a regular expression across all memory for all (accessible) processes. This could be used to find sensitive data in memory, identify a process by something included in its memory, or to interrogate a processes' memory for interesting information.

There are many built-in patterns included via the scan command, which effectively works as a secret scanner against the memory on your machine.

Dismember can be used to search memory of all processes it has access to, so running it as root is the most effecti.

Commands are also included to list processes, explore process status and related information, draw process trees, and more...

Main Commands

| Command | Description |
|-----------|------------------------------------------------------------------------------------------|
| grep | Search process memory for a gi or regex |
| scan | Search process memory for a set of predefined secret patterns |

Utility Commands

| Command | Description |
|-----------|------------------------------------------------------------------------------------------|
| files | Show a list of files being accessed by a process |
| find | Find a PID given a process name. If multiple processes match, the first one is returned. |
| info | Show information about a process |
| kernel | Show information about the kernel |
| kill | Kill a process (or processes) using SIGKILL |
| list | List all processes currently a on the system |
| resume | Resume a suspended process using SIGCONT |
| suspend | Suspend a process using SIGSTOP (use 'dismember resume' to lea) |
| tree | Show a tree diagram of a process and all children (defaults to PID 1). |

Installation

Grab a binary from the latest release and add it to your path.

Usage Examples

Search for a pattern in a process by PID

Search for a pattern in a process by name

Search for a pattern across all processes

Search for secrets in memory across all processes

FAQ

> Isn't this information all just sitting in /proc?

Pretty much. Dismember just reads and presents it for the most part. If you can get away with grep whatever /proc/[pid]/blah then go for it! I built this as an educational experience because I couldn't sleep one night and stayed up late reading the proc man-pages (I live an extremely rock 'n' roll lifestyle). It's not a replacement for existing tools, but perhaps it can complement them.

> Do you know how horrific some of these commands seem when read out of context?

Yes.

项目信息

开发语言：Go

Star 数：674

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。