aquasecurity / aquasecurity/tracee
Capture an ELF file upon mem_prot_alert
Open
area/capture
kind/feature
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
We currently only capture the memory region that the alert is related.
However, for real forensics, capturing an ELF file is much better.
We can do it by capturing all ELF relating memory segments (aka unmapped or ELF mapped regions) in addition to the relevant area.
Then by creating an ELF header we can create an imitation of the original ELF.
Contributor guide
Assessment
This issue has not been assessed yet.