MemProcFS version 4.0 and above is supported on Linux. Pre-built binaries exist for x64 and aarch64 (RPi4). MemProcFS is dependent on the following packages: sudo apt-get install libusb-1.0 fuse openssl lz4

It's possible to use the MemProcFS either as a FUSE file system or via it's C/C++ API or its Python API.

The Python version of MemProcFS requires Python 3.6+ and is available on Python pip. Please install with: pip install memprocfs or pip3 install memprocfs. Make the dependencies are covered before installing: sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev fuse libfuse-dev openssl libssl-dev lz4 liblz4-dev

MemProcFS is dependent on packages, before building please do a: sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev fuse libfuse-dev openssl libssl-dev lz4 liblz4-dev

MemProcFS is also available on the LeechCore library. Clone leechcore and place it alongside MemProcFS. First build LeechCore. Then build MemProcFS vmm.so by typing make in the MemProcFS/vmm directory. Then build the MemProcFS FUSE wrapper by typing make in the MemProcFS/memprocfs directory.

~$  sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev fuse libfuse-dev openssl libssl-dev lz4 liblz4-dev
~$  mkdir build
~$  cd build
~/build$  git clone https://github.com/ufrisk/LeechCore
~/build$  git clone https://github.com/ufrisk/MemProcFS
~/build$  cd LeechCore/leechcore
~/build/LeechCore/leechcore$  make
~/build/LeechCore/leechcore$  cd ../../MemProcFS/vmm
~/build/MemProcFS/vmm$  make
~/build/MemProcFS/vmm$  cd ../memprocfs
~/build/MemProcFS/memprocfs$  make
~/build/MemProcFS/memprocfs$  cd ../files
### NOTE! before running memprocfs it's recommended to copy the file 'info.db' from the latest binary
### release at https://github.com/ufrisk/MemProcFS/releases/latest and put it alongside memprocfs binary.
### info.db is an sqlite database which contains common type and symbol offsets required for some tasks.
~/build/MemProcFS/files$  ./memprocfs -device <your_dumpfile_or_device> -mount <your_full_mount_point>

MemProcFS for Linux currently do not support:

• Compressed Memory
• Microsoft symbol server debug symbols (pdbs) - limited support for cached symbols however exist retrieved from the info.db database.

The lack of compressed memory support will somewhat degrade results and may lead to lower quality and/or missed results. It's unknown when compressed memory will be implemented.