MemProcFS version 4.0 and above is supported on Linux. Pre-built binaries exist for x64 and aarch64 (RPi4). MemProcFS is dependent on the following packages: sudo apt-get install libusb-1.0 fuse openssl lz4

It's possible to use the MemProcFS either as a FUSE file system or via it's C/C++ API or its Python API.

The Python version of MemProcFS requires Python 3.6+ and is available on Python pip. Please install with: pip install memprocfs or pip3 install memprocfs. Make the dependencies are covered before installing: sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev fuse libfuse-dev openssl libssl-dev lz4 liblz4-dev

MemProcFS is dependent on packages, before building please do a: sudo apt-get install make gcc pkg-config libusb-1.0 libusb-1.0-0-dev fuse libfuse-dev openssl libssl-dev lz4 liblz4-dev

MemProcFS is also available on the LeechCore library. Clone leechcore and place it alongside MemProcFS. First build LeechCore. Then build MemProcFS vmm.so by typing make in the MemProcFS/vmm directory. Then build the MemProcFS FUSE wrapper by typing make in the MemProcFS/memprocfs directory.

MemProcFS for Linux currently do not support:

• Compressed Memory
• Microsoft symbol server debug symbols (pdbs).

The lack of compressed memory support will somewhat degrade results and may lead to lower quality and/or missed results. It's unknown when compressed memory will be implemented.

The lack of symbol server functionality - and following missing functionality is planned to be addressed after the summer in an update.