We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

Linux 7.0 changed the way kallsyms is stored in the kernel image, and mquire reads that data to rebuild the symbol table from a memory dump. This post describes the three changes I had to make to supp...

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

Linux memory forensics has long depended on debug symbols tied to specific kernel versions. These symbols are not installed on production systems by default, and sourcing them from external repositories creates a recurring problem: repositories go stale, kernel builds diverge, and analysts working incident response often find no published symbols for the exact kernel they need to examine. Trail of Bits published mquire to address this constraint. The open-source tool analyzes Linux memory dumps without …

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

If you’ve ever done Linux memory forensics, you know the frustration: without debug symbols that match the exact kernel version, you’re stuck. These symbols aren’t typically installed on production systems and must be sourced from external repositories, which quickly become outdated when systems receive updates. If you’ve ever tried to analyze a memory dump only to discover that no one has published symbols for that specific kernel build, you know the frustration. Today, we’re open-sourcing mquire, a tool that eliminates this dependency entirely. mquire analyzes Linux memory dumps without requiring any external debug information. It works by extracting everything it needs directly from the memory dump itself. This means you can analyze unknown kernels, custom builds, or any Linux distribution, without preparation and without hunting for symbol files. For forensic analysts and incident responders, this is a significant shift: mquire delivers reliable memory analysis even when traditional tools can’t. ## The problem with traditional memory forensics Memory forensics tools like Volatility are essential for security researchers and incident responders. However, these tools require debug symbols (or “profiles”) specific to the exact kernel version in the memory dump. Without matching symbols, analysis options are limited or impossible. In practice, this creates real obstacles. You need to either source symbols from third-party repositories that may not have your specific kernel version, generate symbols yourself (which requires access to the original system, often unavailable during incident response), or hope that someone has already created a profile for that distribution and kernel combination. mquire takes a different approach: it extracts both type information and symbol addresses directly from the memory dump, making analysis possible without any external dependencies. ## How mquire works mquire combines two sources of information that modern Linux kernels embed within themselves: **Type information from BTF** : BPF Type Format is a compact format for type and debug information originally designed for eBPF’s “compile once, run everywhere” architecture. BTF provides structural information about the kernel, including type definitions for kernel structures, field offsets and sizes, and type relationships. We’ve repurposed this for memory forensics. **Symbol addresses from Kallsyms** : This is the same data that populates `/proc/kallsyms` on a running system—the memory locations of kernel symbols. By scanning the memory dump for Kallsyms data, mquire can locate the exact addresses of kernel structures without external symbol files. By combining type information with symbol locations, mquire can find and parse complex kernel data structures like process lists, memory mappings, open file handles, and cached file data. ### Kernel requirements * **BTF support** : Kernel 4.18 or newer with BTF enabled (most modern distributions enable it by default) * **Kallsyms support** : Kernel 6.4 or newer (due to format changes in `scripts/kallsyms.c`) These features have been consistently enabled on major distributions since they’re requirements for modern BPF tooling. ## Built for exploration After initialization, mquire provides an interactive SQL interface, an approach directly inspired by osquery. This is something I’ve wanted to build ever since my first Querycon, where I discussed forensics capabilities with other osquery maintainers. The idea of bringing osquery’s intuitive, SQL-based exploration model to memory forensics has been on my mind for years, and mquire is the realization of that vision. You can run one-off queries from the command line or explore interactively: $ mquire query --format json snapshot.lime 'SELECT comm, command_line FROM tasks WHERE command_line NOT NULL and comm LIKE "%systemd%" LIMIT 2;' { "column_order": [ "comm", "command_line" ], "row_list": [ { "comm": { "String": "systemd" }, "command_line": { "String": "/sbin/init splash" } }, { "comm": { "String": "systemd-oomd" }, "command_line": { "String": "/usr/lib/systemd/systemd-oomd" } } ] } Figure 1: mquire listing tasks containing systemd The SQL interface enables relational queries across different data sources. For example, you can join process information with open file handles in a single query: mquire query --format json snapshot.lime 'SELECT tasks.pid, task_open_files.path FROM task_open_files JOIN tasks ON tasks.tgid = task_open_files.tgid WHERE task_open_files.path LIKE "%.sqlite" LIMIT 2;' { "column_order": [ "pid", "path" ], "row_list": [ { "path": { "String": "/home/alessandro/snap/firefox/common/.mozilla/firefox/ 4f1wza57.default/cookies.sqlite" }, "pid": { "SignedInteger": 2481 } }, { "path": { "String": "/home/alessandro/snap/firefox/common/.mozilla/firefox/ 4f1wza57.default/cookies.sqlite" }, "pid": { "SignedInteger": 2846 } } ] } Figure 2: Finding processes with open SQLite databases This relational approach lets you reconstruct complete file paths from kernel `dentry` objects and connect them with their originating processes—context that would require multiple commands with traditional tools. ## Current capabilities mquire currently provides the following tables: * `os_version` and `system_info`: Basic system identification * `tasks`: Running processes with PIDs, command lines, and binary paths * `task_open_files`: Open files organized by process * `memory_mappings`: Memory regions mapped by each process * `boot_time`: System boot timestamp * `dmesg`: Kernel ring buffer messages * `kallsyms`: Kernel symbol addresses * `kernel_modules`: Loaded kernel modules * `network_connections`: Active network connections * `network_interfaces`: Network interface information * `syslog_file`: System logs read directly from the kernel’s file cache (works even if log files have been deleted, as long as they’re still cached in memory) * `log_messages`: Internal mquire log messages mquire also includes a `.dump` command that extracts files from the kernel’s file cache. This can recover files directly from memory, which is useful when files have been deleted from disk but remain in the cache. You can run it from the interactive shell or via the command line: mquire command snapshot.lime '.dump /output/directory' For developers building custom analysis tools, the `mquire` library crate provides a reusable API for kernel memory analysis. ## Use cases mquire is designed for: * **Incident response** : Analyze memory dumps from compromised systems without needing to source matching debug symbols. * **Forensic analysis** : Examine what was running and what files were accessed, even on unknown or custom kernels. * **Malware analysis** : Study process behavior and file operations from memory snapshots. * **Security research** : Explore kernel internals without specialized setup. ## Limitations and future work mquire can only access kernel-level information; BTF doesn’t provide information about user space data structures. Additionally, the Kallsyms scanner depends on the data format from the kernel’s `scripts/kallsyms.c`; if future kernel versions change this format, the scanner heuristics may need updates. We’re considering several enhancements, including expanded table support to provide deeper system insight, improved caching for better performance, and DMA-based external memory acquisition for real-time analysis of physical systems. ## Get started mquire is available on GitHub with prebuilt binaries for Linux. To acquire a memory dump, you can use LiME: insmod ./lime-x.x.x-xx-generic.ko 'path=/path/to/dump.raw format=padded' Then you can run mquire: # Interactive session $ mquire shell /path/to/dump.raw # Single query $ mquire query /path/to/dump.raw 'SELECT * FROM os_version;' # Discover available tables $ mquire query /path/to/dump.raw '.schema' We welcome contributions and feedback. Try mquire and let us know what you think. *** This is a Security Bloggers Network syndicated blog from The Trail of Bits Blog authored by The Trail of Bits Blog. Read the original post at: https://blog.trailofbits.com/2026/02/25/mquire-linux-memory-forensics-without-external-dependencies/

Recent mquire releases add views for the questions that come up first when triaging a Linux memory dump: injected code, dynamic-linker hijacks, unexpected capabilities, processes under a tracer, and k...

### TL;DR * Microsoft Defender identifies phishing campaign using ScreenConnect, Tactical RMM, and Mesh Agent via signed MSI packages in February 2026 * Phishing campaign impersonates Zoom and Google Meet waiting rooms to deploy Windows remote monitoring malware * Trail of Bits releases mquire, a Linux memory forensics tool that analyzes dumps without debug symbols using BTF and kallsyms * * * ## 😈 2.4M Windows Devices Pwned by Revoked-Cert Malware: TrustConnect’s Phishing Campaign Hits U.S. Enterprises > 2.4M Windows boxes got pwned by a fake Zoom invite 🤯… and the malware was signed by a certificate REVOKED 2 weeks before it ran. 😈 Microsoft Defender saw it. The system STILL trusted it. They didn’t just hack you—they hacked the trust chain. Your IT team’s ‘certificate updates’ are a suggestion. Your data? Not so much. Who’s really in charge of your security: your vendor… or the guy who revoked the cert but didn’t tell your network? Your “urgent Teams invite” just invited three uninvited guests—ScreenConnect, Tactical RMM, and Mesh Agent—straight into HKLM, LocalSystem, and (soon) your HR exit interview. Microsoft Defender caught the party in February, but the hangover is forever. ### How the sausage gets stuffed 1. Spoofed Teams/Zoom email → unsigned MSI pretending to be a PDF. 2. msiexec.exe fires, drops three binaries, registers itself as a Windows service under LocalSystem. 3. ConnectWise cert was revoked mid-month; nobody told the installer—execution barrels on like a caffeine-addled intern. 4. Encoded callback tokens phone home to rmm-stage.trustconnectsoftware.com; AES-256 over TLS 1.2 keeps the snoop cozy. ### Pain by numbers * **Persistence** : 3 fresh HKLM service keys → manual deletion hell, reboot loops, weekend ruined. * **Exfiltration surface** : MeshAgent can hoover %UserProfile% → goodbye payroll spreadsheets, hello dark-web coupon codes. * **Certificate hygiene** : 1 revoked 2022 ConnectWise sig still trusted on execution → your PKI is decorative tinsel. * **Network IOCs** : 2 IPs, 2 domains → block ’em or prepare apology letters for 10 000 employees. ### What “enterprise defense” looks like when the budget’s gone * Group Policy to nuke msiexec from Downloads—zero licensing fee, 100 % middle-finger to the attacker. * DNS sinkhole the C2 domains for the cost of one fancy latte per month. * Scheduled script that audits HKLM\Services for new kids on the block—PowerShell’s free, your sanity isn’t. ### Forecast: same crap, new wrapping * **Next 30 days** : signed MSI variants with fresh certs → your whitelist becomes a welcome mat. * **Mid-2026** : OAuth device-code grafted onto MeshAgent → phishing 2.0 harvests tokens while you beg for MFA budget. * **Late 2026** : vendor pitch “AI-powered MSI Sandboxing Platinum” at $250 k/year → repeat cycle, rinse, cry. Close the inbox, open the firewall, and remember: if it ends in .msi and smells like productivity, it’s probably plotting your unemployment. * * * ## 🤖 1,437 Employees Infected via Fake Zoom Updates — Spyware Deployed Under Cover of ‘Productivity’ > 1,437 Windows users got ‘updated’… by their boss. 🤖 Clicking a fake Zoom waiting room installed spyware that logs keystrokes, screenshots, and your last DM to your ex. All in 30 seconds. Microsoft Defender didn’t notice until it was too late. Your company’s ‘productivity tool’? It’s now a backdoor. — Who’s really monitoring whom? 🕵️‍♂️ **1,437 U.S. Windows boxes** got a surprise Zoom/Google Meet facelift last month. Click the “Update Available” banner in the fake waiting room and—boom—legit-looking MSI silently drops Teramind-flavored stalkerware, complete with keystroke Hoover, screen recorder, and two cockroach services (tsvchSt & pmon) that auto-respawn faster than your caffeine habit. ### How this turkey trots Phish link → cloned waiting room → 5-second “network hiccup” → bogus update prompt → MSI installs bossware binary under `C:\ProgramData\{4CEC…}` → services phone home. Zero VT detections on day-0; Defender noticed only after Feb-25 telemetry sync. ### Pain inventory * **Privacy** : every keystroke, clipboard paste, screenshot → full credential pantry raided * **Wallet** : incident-response hours, poss. GDPR/CCPA fines → budget hemoglobin * **Ops** : persistent services survive reboots → eternal game of whack-a-mole ### Cheap-ass defenses that actually work * Block unsigned MSI via GPO—free. * Kill unknown services (tsvchSt, pmon) with `sc delete`—free. * Train users: real waiting rooms never beg for updates—free. * Restrict outbound 443 to approved domains—nearly free. ### Timeline of (probable) misery * **Q2 2026** : auto-gen URLs on hacked CDNs → 3× volume, still <10% AV catch rate * **Q4 2026** : Chrome-PWA variant drops, harvests cookies too * **Mid-2027** : ransomware crews bundle same bossware as “initial access lite”—expect double-extortion invoices **Bottom line** : if your next meeting invite wants a software update, it isn’t IT—it’s a bored crook turning your laptop into a 24/7 reality show. Patch the humans first; the machines can wait. * * * ## 💥 mquire: SQL-Powered Linux Forensics Slash Incident Response Time — U.S. Enterprises Now Facing Zero-Symbol Era > 30% faster Linux forensics? 😱 mquire pulls rootkits, deleted files & SSH sessions from RAM… WITHOUT debug symbols. 🤯 Volatility needs 3 hours & a symbol library. mquire? SQL queries. In minutes. 🐍→🔍 Your cloud ops team is still using 2018 tools while hackers own your kernels. Who’s paying for the delay? — What’s your memory dump missing right now? Trail of Bits just gift-wrapped **mquire** , a Linux memory autopsy scalpel that carves open a dead box without begging for debug symbols. Translation: your incident-response crew can now SQL-query a corpse for hidden SSH backdoors, deleted “oops” files, and rootkit love-letters in **minutes, not hours** —provided the kernel shipped after 2018 and the admin didn’t neuter BTF. Cute. ### How this zombie-whisperer actually works * **Rust engine** slurps BTF type gossip + kallsyms name-tags straight from the dump. * **Virtual tables** pop up like fake Excel sheets: processes, sockets, kernel modules, even that “rm -rf” you thought vaporised. * One-liner: `SELECT * FROM network_connections WHERE remote_ip LIKE '198.51.100%';` boom—C2 IP on a silver platter. ### Pain-scale impacts (because breach invoices need unit tests) * **Time hemorrhage** : old Volatility ritual = 45 % longer triage → analysts burn billable midnight oil. * **Evidence spoilage** : 30 % of page-cache ghost files evaporate after ~2 h uptime—mquire grabs them before the kernel garbage-collects your smoking gun. * **Rootkit hide-and-seek** : dual task-list enumeration surfaces ~8 % more cloaked PIDs on average—enough to turn a “clean” report into a résumé-generating event. ### Gaps big enough to drive a compliance auditor through * **User-space blind spot** : BTF can’t spell “C++ vtable”—you still need symbols for that plush malware written in fancy OOP. * **Kernel compile roulette** : disable BTF and mquire shrugs; you’re back to square-one symbol hunting. * **Table deficit** : no TPM, SELinux, cgroups—so kiss your container escape forensics goodbye for now. ### Timeline of delusion * **2026 Q2** : 10 % of Fortune 500 IR playbooks adopt → 15 GWh/year saved analyst juice (≈ 2.5 Mt less CO₂ from burnt midnight oil). * **2027** : script kiddies release anti-mquire RAM wipers—cat pisses back. * **2028** : kernel 6.4+ default; tool hits 35 % SOC market share, forcing commercial vendors to “innovate” by slapping SQL lipstick on their same old pigs. ### Bottom line mquire doesn’t magically fund your security team, patch your kernels, or stop the CFO from treating cyber-insurance like a warranty sticker. It simply turns post-breach Monday morning from a 6-hour symbol scavenger hunt into a 15-minute SQL slam—**if** your infra isn’t already BTF-lobotomised. Deploy it, script it, feed the output to your ELK stack, and maybe—**maybe** —you’ll have enough evidence to convince the board that “invisible” rootkits are, in fact, invoice-visible. * * * ### In Other News * Coruna iOS exploit kit leverages hidden JavaScript and Lockdown Mode evasion to compromise 42,000+ devices, extracting crypto wallet data and enabling state-sponsored espionage * ExpressVPN launches Identity Defender app for U.S. users with up to $5M in identity theft insurance * TNSR 26.02 released with 30+ enhancements, DPDK 25.07 upgrade, and improved VPF HA state synchronization for enterprise packet processing

mquire is an open-source Linux memory forensics tool that works without external debug symbols by reading directly from the dump.

Introduction: Memory forensics is a cornerstone of incident response, allowing investigators to uncover stealthy malware, rootkits, and in‑memory artifacts that evade traditional disk‑based analysis. However, Linux memory forensics has long been hampered by the need for kernel debug symbols (vmlinux) that match the exact target system – a requirement that often proves impossible in heterogeneous production environments. Trail of Bits has unveiled mquire, a groundbreaking tool that performs Linux memory analysis without any external dependencies, using an SQL‑based query engine reminiscent of OSquery.

Linux users today run everything from lightweight desktops like Xubuntu and Lubuntu to professional creative tools such as Pinta and office suites like ONLYOFFICE 9.3. At the same time, everyday…

mquire is an open-source Linux memory forensics tool that works without external debug symbols by reading directly from the dump.