Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Simple memory duplication identifying tool for Android-x86
Fetching latest commit…
Cannot retrieve the latest commit at this time.
|Type||Name||Latest commit message||Commit time|
|Failed to load latest commit information.|
MemScope ======== MemScope is a simple python script for identifying duplicated pages on Android-x86 system based on physical memory snapshots. MemScope has two functionalities. Snapshot Acquisition -------------------- MemScope requires physical memory snapshot or memory dump in order to identify page duplication. To get memory snapshots easily, it is good to use virtual machine. MemScope provides a way to interact with QEMU and take snapshots periodically. Duplication Identification -------------------------- With the help of volatilitux, written by Emilien Girault, MemScope explores memory spaces of all Android processes, including application process and system process. During the explore it constructs duplication table based on hash of each page content. Assumption ---------- MemScope assumes that each page used for virtual memory has size of 4KiB. Environment ----------- MemScope was tested with Android-x86 kitkat 4.4.4. Note ---- MemScope has not been written to be used as python module.