Trail of Bits is open-sourcing mquire, a Linux memory forensics tool that eliminates the need for external debug symbols or kernel profiles. Instead of relying on third-party symbol repositories, mquire extracts type information directly from BTF (BPF Type Format) embedded in the kernel and locates symbol addresses via Kallsyms data within the memory dump itself. This makes it possible to analyze unknown, custom, or any Linux kernel build without preparation. The tool provides an interactive SQL interface inspired by osquery, supporting queries across tables like running processes, open files, memory mappings, network connections, kernel modules, and dmesg. It can also recover deleted files still cached in memory. Requires kernel 4.18+ with BTF enabled and kernel 6.4+ for Kallsyms support. Targeted at incident responders, forensic analysts, and security researchers.
