Windows Memory Forensics MCP
WARNING: PROOF OF CONCEPT
This is a proof-of-concept implementation developed for research and CTF purposes. Use at your own risk. Not recommended for production forensic investigations without thorough testing and validation.
A Model Context Protocol (MCP) server for Windows memory forensics. Provides AI agents with 33 tools for analyzing memory dumps using Volatility 3, MemProcFS, and CLR analysis backends.
Author: Jacob Krell
Prerequisites
Before running setup, ensure you have:
- Python 3.10+ - Download from python.org
- Visual C++ Build Tools - Required for yara-python compilation
- Download Visual C++ Build Tools
- During installation, select "Desktop development with C++" workload
- This is required for YARA scanning functionality
Quick Setup (One Command)
# Clone and setup
git clone https://github.com/0xhackerfren/windows-memory-forensics-mcp.git
cd windows-memory-forensics-mcp
.\setup.ps1
The setup script will:
- Create a Python virtual environment
- Install all dependencies (Volatility 3, MemProcFS, pefile, yara-python)
- Verify the installation
- Print configuration instructions for Cursor/Claude
After setup, verify with a memory dump:
python verify_setup.py C:\path\to\memory.raw
AI Agent Usage
For AI agent guidance, see AGENT_RULES.md - this file contains:
- Complete tool reference
- Investigation workflow patterns
- Common analysis patterns
- Example commands
You can use AGENT_RULES.md as:
- A Cursor rule (copy to
.cursor/rules/) - A Claude Desktop system prompt
- A reference document
Disclaimer
This software is provided "as-is" for research, education, and CTF purposes.
- No warranty or guarantee of accuracy or completeness
- Test thoroughly before using on real forensic evidence
- Not intended for production use - validate all results independently
- The author is not responsible for any damages, data loss, or incorrect conclusions drawn from this tool
- Always follow proper chain-of-custody procedures for real forensic investigations
Features
- Pluggable Backends: Volatility 3, MemProcFS, cdb.exe, dotnet-dump
- Process Analysis: List processes, command lines, DLLs, handles
- Malware Detection: malfind, hidden module detection, injection detection
- Memory Extraction: VAD dumping (raw and reconstructed), arbitrary memory reads
- CLR/.NET Analysis: Deep .NET inspection via SOS commands on minidumps
- Staged Payload Reconstruction: Extract and decode payloads from environment variables (PASTALOADER, GrimResource patterns)
- Network Forensics: Network connection enumeration
MCP Client Configuration
Cursor IDE
Add to .cursor/mcp.json (create the file if it doesn't exist):
{
"mcpServers": {
"memory-forensics-mcp": {
"command": "C:/path/to/windows-memory-forensics-mcp/venv/Scripts/python.exe",
"args": ["C:/path/to/windows-memory-forensics-mcp/src/memory_forensics_mcp.py"]
}
}
}
Important: Use the virtual environment Python (venv/Scripts/python.exe) to ensure dependencies are available.
Restart Cursor to load the MCP.
Claude Desktop / Claude Code
Add to %APPDATA%\Claude\claude_desktop_config.json:
{
"mcpServers": {
"memory-forensics-mcp": {
"command": "C:/path/to/windows-memory-forensics-mcp/venv/Scripts/python.exe",
"args": ["C:/path/to/windows-memory-forensics-mcp/src/memory_forensics_mcp.py"]
}
}
}
Restart Claude Desktop to load the MCP.
Available Tools (33)
Process Analysis
Memory Extraction
VFS Browsing (MemProcFS)
Malware Detection
Network Forensics
Registry Analysis
CLR/.NET Analysis
Staged Payload Analysis
Tagging and Timeline (AI Workflow)
Utility
Usage Examples
Basic Process Analysis
# List all processes
result = list_processes(memory_file="C:/evidence/memory.raw")
for proc in result["results"]:
print(f"PID {proc['PID']}: {proc['ImageFileName']}")
# Get command line for suspicious process
cmdline = get_cmdline(memory_file="C:/evidence/memory.raw", pid=1234)
print(cmdline["results"])
Detect Hidden/Injected Modules
# Use ldrmodules to find modules with suspicious flags
ldr = ldrmodules(memory_file="memory.raw", pid=3120)
for mod in ldr["results"]:
if not mod["InLoad"] and not mod["InInit"] and not mod["InMem"]:
print(f"Hidden module: {mod['Base']} - {mod['MappedPath']}")
# Or use the automated detection
hidden = find_hidden_modules(memory_file="memory.raw", pid=3120)
print(f"Found {hidden['count']} hidden modules")
Detect Staged Payloads (PASTALOADER/GrimResource Pattern)
# Extract environment variables with a specific prefix
env = get_process_environment(
memory_file="memory.raw",
pid=3120,
filter_prefix="B_" # PASTALOADER uses B_1, B_2, ... B_N
)
print(f"Found {env['filtered_count']} staged payload chunks")
# Reconstruct the payload
payload = reconstruct_staged_payload(
memory_file="memory.raw",
pid=3120,
var_prefix="B_",
decode_algorithm="pastaloader",
output_path="./output/reconstructed_payload.bin"
)
print(f"Payload MD5: {payload['md5']}")
Backends
The setup script installs all backends automatically:
Optional External Tools
Backend Selection
Most tools support an engine parameter:
# Auto-select best available backend (default)
list_processes(memory_file="memory.raw", engine="auto")
# Force Volatility 3
list_processes(memory_file="memory.raw", engine="volatility")
# Force MemProcFS
list_processes(memory_file="memory.raw", engine="memprocfs")
Troubleshooting
Common Issues
Verify Installation
# Check backends only
python verify_setup.py --check-only
# Full test with memory file
python verify_setup.py C:\path\to\memory.raw
Manual Installation
If setup.ps1 fails, install manually:
python -m venv venv
.\venv\Scripts\Activate.ps1
pip install mcp volatility3 pefile memprocfs
Project Structure
windows-memory-forensics-mcp/
+-- src/
| +-- memory_forensics_mcp.py # Main MCP server
+-- examples/
| +-- basic_analysis.py # Basic usage examples
| +-- malware_detection.py # Malware detection workflow
| +-- staged_payload.py # Staged payload reconstruction
| +-- quickstart.py # Quick verification script
+-- .cursor/
| +-- mcp.json.example # Cursor configuration example
+-- setup.ps1 # One-command setup script
+-- verify_setup.py # Installation verification
+-- AGENT_RULES.md # AI agent usage guide
+-- requirements.txt # Python dependencies
+-- pyproject.toml # Package metadata
+-- LICENSE # MIT License
+-- README.md # This file
Requirements
- Windows 10/11
- Python 3.10+
- PowerShell 5.1+ (for setup.ps1)
All Python dependencies are installed automatically by setup.ps1.
Contributing
Contributions are welcome! Please:
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
License
This project is licensed under the MIT License - see the LICENSE file for details.
Author
Jacob Krell - Creator and maintainer
Acknowledgments
- Volatility Foundation for Volatility 3
- Ulf Frisk for MemProcFS
- Anthropic for the MCP specification
- Hack The Box for the Sherlock challenges that drove development
Related Projects
- Volatility 3 - Memory forensics framework
- MemProcFS - Memory Process File System
- MCP Specification - Model Context Protocol
Proof of Concept - Created from real-world DFIR investigations. Battle-tested on HTB Sherlock challenges including Novitas (Insane difficulty).
Use at your own risk. Always validate forensic findings through multiple methods.
