Eni Memory Forensics

---
name: eni-memory-forensics
description: 全局自动路由 | Cross-platform process memory, dump, runtime, heap, pointer-chain, signature, structure, and memory-forensics analysis for Windows, Linux, Android, Unity IL2CPP, Unreal, native applications, crash dumps, and raw memory images.
x-alice-class: reverse
---

# Cold Coffee Memory Forensics

Resolve runtime addresses and structures from evidence, then produce repeatable tooling.

## Start

1. Establish architecture, pointer width, endianness, target OS/runtime, and artifact type.
2. Distinguish absolute addresses, module-relative offsets, signatures, pointer chains, handles, and generated references.
3. Record module mappings, page protections, thread/heap context, and address provenance.
4. Use `scripts/aob_scan.py` for wildcard byte-pattern scans and `scripts/dump_strings.py` for offset-aware ASCII/UTF-16 extraction.

## Select references

- Windows live process, dumps, WinDbg, RPM/WPM: read `references/windows.md`.
- Linux, Android, Frida, IL2CPP: read `references/linux-android.md`.
- Raw dumps, structures, pointer chains, memory forensics: read `references/dump-structures.md`.

## Execute

- Prefer module resolution, signatures, and validated pointer paths over hard-coded absolute addresses.
- Use controlled state changes, memory diffs, watchpoints, allocation hooks, and access-width patterns to recover structures.
- Verify readable/writable regions and bounds before access.
- For patches, capture original bytes, validate expected bytes, restore protections, and provide rollback.

## Deliver

Return the address derivation, mapping evidence, recovered structure, complete reader/scanner/hook/patch code, error handling, logs, and verification steps.