TLDR Tech / InfoSec
mquire (GitHub Repo)
mquire is an osquery-inspired memory forensics tool that enables SQL-based querying of Linux kernel memory snapshots without requiring external debug symbols. Written in Rust, it leverages embedded BTF and Kallsyms data to enumerate processes, open files, and network connections, and to extract cached files directly from memory dumps. Designed for incident response and malware analysis, it supports interactive shell, single-query, and custom command modes, including process tree visualization and file carving.
Read the full story