mem_strings
Search a memory image for a literal string and return byte offsets. Correlate disk artifacts with memory evidence to verify cross-source IOCs.
Instructions
Search a memory image for a literal string and return byte offsets (strings + grep, no symbol table required). Use this for cross-source IOC correlation: confirm that an artifact found on disk (a webshell filename, an attacker IP, a created account name) is also resident in memory. Works on any raw memory image regardless of OS profile.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| image | Yes | ||
| pattern | Yes | ||
| ignore_case | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |