Just a idea.
At the moment Haystack parses a memory dump in a file.
Maybe it would be great, to map a process memory, and then directly parse it without an intermediary file.
For example on linux we could use /proc/$pid/maps :
http://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux
On Windows, with the function ReadProcessMemory():
http://stackoverflow.com/questions/19606159/c-reading-memory-of-another-process
This would also give the possibility to scan a process memory while it is running without blocking it, which would indeed yield imprecise results if the data are being modified, but this might be enough (At least in my case)
Just a idea.
At the moment Haystack parses a memory dump in a file.
Maybe it would be great, to map a process memory, and then directly parse it without an intermediary file.
For example on linux we could use /proc/$pid/maps :
http://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux
On Windows, with the function ReadProcessMemory():
http://stackoverflow.com/questions/19606159/c-reading-memory-of-another-process
This would also give the possibility to scan a process memory while it is running without blocking it, which would indeed yield imprecise results if the data are being modified, but this might be enough (At least in my case)