memory_analyze_image
Initiate memory dump forensics with automatic OS structure detection, using Rust engine first and Volatility3 fallback. Returns a session ID for subsequent analysis.
Instructions
Initialize memory image analysis. Tries Rust engine first (fast ISF auto-detection), falls back to Vol3. Returns session ID for subsequent operations.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dtb | No | Override DTB (hex or decimal, e.g., '0x1ad000') | |
| image_path | Yes | Path to memory dump file (.raw, .vmem, .dmp, .lime, .mem) | |
| kernel_base | No | Override kernel base address (hex or decimal) |