mquire: Linux memory forensics without external dependencies

Summary: Trail of Bits has open-sourced mquire, a Linux memory forensics tool that analyzes memory dumps without external debug symbols by extracting type information from BTF and symbol addresses from Kallsyms embedded in the dump itself. The tool provides an interactive SQL interface inspired by osquery, with tables for process lists, memory mappings, open file handles, and cached file data, plus a .dump command to recover files from the kernel's file cache.
Why it matters: Traditional tools like Volatility stall when no one has published symbols for a specific kernel build, a gap that hits during incident response when the original system is unavailable to generate them; mquire removes that dependency, but it only reaches kernel-level data, since BTF carries no user-space structures.

Read the original at Trail of Bits Blog ↗