LensAnalysis open source: a graphical memory forensics tool based on Volatility 3, good news for CTF players

There has always been a threshold for memory forensics: Volatility is powerful, but the command line parameters are too many to discourage. Now there is a domestic open source tool that has broken down this threshold-LensAnalysis, a graphical memory forensics tool based on Volatility 3, was officially open sourced on September 15.

The developer is hilyary, who chose to open source code during the 2026 National Cyber Security Awareness Week (September 14-20). The theme happens to be "Cyber Security for the People, Cyber Security Depends on the People - Cyber Security Escort in the Intelligent Era". This time point was chosen very appropriately.

What pain point does it solve?

Anyone who does memory forensics knows that Volatility 3 is an industry standard framework, but it is a pure command line operation: the plug-in name must be remembered, the parameters must be correct, and the symbol table must be created by yourself. Time is tight at the CTF competition site, and the emergency response site is under great pressure. If you enter a wrong parameter, you may wait a long time in vain.

What LensAnalysis does is straightforward:Put all the capabilities of Volatility 3 into a graphical interface. Select the plug-in on the left panel, click it to execute, and the results will be displayed on the right in real time. Comes with smart caching, providing second-level response for repeated operations.

Supported analytical capabilities

Covering the three major platforms of Windows, Linux, and macOS, the number of plug-ins is considerable:

Windows (60+ plugins):

• process analysis：pslist, pstree, psscan, dlllist, handles, cmdline
• network analysis: netscan, netstat (including complete timestamp)
• Registry：hivelist, printkey, certificates, userassist
• Malicious code: malfind, ldrmodules, hollowprocesses
• Password extraction：hashdump, lsadump, cachedump
• Service scan:svcscan, svclist

Linux: pslist/pstree/psaux/envars, netstat/sockstat/ip_addr/ip_link, lsmod/check_modules/check_syscall, bash command history extraction, lsof/list_files/mount_info, malfind/check_idt/check_afinfo.

macOS: pslist/pstree/psaux/envars, netstat/ifconfig, lsmod, lsof/list_files/mount, timers/kauth_listeners/vfsevents.

Several real hassle-free features

• Flag search: Automatically search for common Flag formats (flag{xxx}), good news for CTF players
• Regular search: Custom regular expression to mine data in memory
• String extraction: Extract all printable strings with one click
• Automatic creation of Linux symbol table: Automatically download the dbgsym debugging symbol package from the official source and convert it into the ISF format of Volatility 3. Supports Ubuntu, Debian, CentOS - no need to manually find the symbol table
• Agent support: HTTP/HTTPS/SOCKS5, the symbol table can also be downloaded in the intranet environment
• Report export: Markdown, HTML, Word three formats

The "automatic creation of symbol tables" deserves a separate mention. Anyone who has worked on Volatility 3 knows that the symbol table is one of the biggest pitfalls - different distributions and different kernel versions require corresponding symbols, and it can take a whole day to do it manually. This function directly automates it.

How to install and use

There are ready-made packages for the three platforms:

• Windows: Download LensAnalysis.exe and double-click to run it. Read and agree to the terms of use when starting for the first time. Enter your personal ID on the welcome page to enter (now open source, no machine code or activation code required)
• macOS(12+): Download .dmg, drag it into Applications, right click → Open when running for the first time
• Linux: Download .tar.gz, decompress and run run.sh, source code running is also supported.

There are four steps to the usage process: Load the image (.raw/.mem/.vmem, etc., the system will automatically detect the type) → Select the plug-in on the left to execute → View the results on the right → Export the report.

⚠️ The Windows installation package is packaged by Python and is not yet code-signed. Some anti-virus software will falsely report it. Be sure to download it from the official Releases.

License: Free for non-commercial use, authorization required for commercial use

Make this point clear to avoid pitfalls:

• ✅ Personal study, security research, CTF competitions, teaching, authorized penetration testing and incident response – all free
• ✅ Modification, distribution, and non-commercial secondary development are allowed on the premise of retaining the original author and copyright information.
• ❌ Without written authorization, you are not allowed to sell software, provide paid services, or integrate it into commercial products
• ❌ Do not remove or modify copyright information, and do not pass the modified version off as the official version

If you want to use it commercially, you must first contact the original author to obtain written authorization. The complete terms are subject to the LICENSE in the warehouse.

Why it's worth paying attention to

Memory forensics is a core skill for emergency response and threat hunting, but the tool chain has always been "hardcore". The significance of LensAnalysis is to lower the threshold - it does not build a new wheel, but wraps the mature engine of Volatility 3 in an easy-to-use shell, and also fills in the biggest pitfall of the symbol table.

For CTF players, it saves time; for emergency responders, it reduces misoperation; for teaching, it makes memory forensics easier to learn. Open source + free for non-commercial use, the threshold is very low.

Of course, tools are just tools. What really determines the quality of Digital Forensics is the analyst's understanding of the memory structure and Digital Forensics ideas. But at least now, you no longer have to worry about remembering command line parameters.

Make memory forensics easier - this slogan, it can live up to it.

Project address: github.com/hilyary/LensAnalysis
Open source time: September 15, 2026
License: Free for non-commercial use, authorization required for commercial use