ufrisk/LeechCore
FreeLeechCore - Physical Memory Acquisition Library & The LeechAgent Remote Memory Acquisition Agent
FreeFree tier
About ufrisk/LeechCore
LeechCore is a physical memory acquisition library that provides API-based access via C/C++, Python, and C#. It supports both software-based methods (RAW dumps, crash dumps, live memory from hypervisors like QEMU and VMware, plus kernel exploits like TotalMeltdown) and hardware-based methods (PCIe TLP via FPGA devices such as ZDMA, GBOX, LeetDMA, and CaptainDMA). The library can be used locally or connected remotely to a LeechAgent over a compressed, mutually authenticated Kerberos-secured network. It is cross-platform (Windows, Linux, macOS) and is the foundation for tools like PCILeech and MemProcFS.
Key Features
API access via C/C++, Python, and C#
Software-based memory acquisition: RAW dumps, Microsoft crash dumps, ELF core dumps, live memory from QEMU, VMware, TotalMeltdown, WinPMEM, LiveKd, etc.
Hardware-based memory acquisition via PCIe TLP over FPGA devices (ZDMA, GBOX, LeetDMA, CaptainDMA, AC701/FT601, USB3380-EVB)
Remote memory acquisition over network using LeechAgent with compressed and mutually authenticated Kerberos security
Supports Windows (32/64-bit), Linux (x64/arm64), and macOS
Used by memory forensics tools PCILeech and MemProcFS
No standalone executable; loaded as a library by other applications
Pros & Cons
Pros
- Open-source and free to use
- Multi-language API (C/C++, Python, C#) for flexible integration
- Broad support for both software and hardware memory acquisition methods
- Remote memory acquisition with compression and strong authentication (Kerberos)
- Cross-platform compatibility (Windows, Linux, macOS)
Cons
- Hardware-based methods require specialized FPGA devices and technical expertise
- Not a standalone tool; requires an application (e.g., PCILeech, MemProcFS) to utilize
- Limited documentation beyond the GitHub wiki; may require deep system knowledge
Best For
Physical memory acquisition for digital forensicsLive memory analysis during incident responseMemory forensics research and developmentAcquiring memory from remote systems over low-bandwidth, high-latency connections
FAQ
What is LeechCore?
LeechCore is a physical memory acquisition library that provides API-based access to various hardware and software memory sources. It is the core library used by PCILeech and MemProcFS.
What platforms does LeechCore support?
LeechCore supports 32/64-bit Windows (DLL), x64 and arm64 Linux (SO), and macOS.
Can LeechCore be used remotely?
Yes, LeechCore can connect to a remote LeechAgent over the network to acquire physical memory or run commands. The connection is compressed and secured with mutually authenticated Kerberos.
Does LeechCore support hardware-based memory acquisition?
Yes, LeechCore supports hardware-based memory acquisition via PCIe TLP using various FPGA devices such as ZDMA, GBOX, LeetDMA, and CaptainDMA.
Is LeechCore free?
Yes, LeechCore is open-source and free to use. It is released under a license on GitHub.