Trail of Bits has open-sourced mquire, a Linux memory forensics tool that eliminates the need for external kernel debug symbols. By utilizing embedded BTF and Kallsyms data, mquire allows incident responders to perform reliable memory analysis on unknown or custom Linux kernels using an intuitive SQL interface.
Memory Forensics
1 post
mquire: Linux memory forensics without external dependencies