← All posts

A browser-based Volatility alternative

2 min read

The Volatility Framework is the reference for memory forensics. It is also a multi-component Python install with symbol packs to manage, plugins to update, and dependencies that fight Python version upgrades. For deep work, that friction is acceptable. For triage — "is this dump worth a deep dive" — it gets in the way. ramparser exists to remove the friction without giving up symbol-accurate analysis.

What ramparser replaces, and what it does not

Replaces:

  • The Python environment, virtualenv, and dependency wrangling.
  • The symbol pack download/copy step. ramparser fetches the matching ntoskrnl PDB on demand (GUID + age only — see is it safe to analyze memory dumps online).
  • The CLI ergonomics of vol -f image.raw windows.pslist | less.

Does not replace:

  • Deep plugins that Volatility 3 has and ramparser does not yet: malfind, yarascan, callbacks, ssdt, vadinfo, timeliner.
  • Non-Windows kernels at depth. macOS is unsupported. Linux is experimental.
  • Process / kernel-region dumping for downstream static analysis.

The split is intentional. ramparser is the triage front-end; Volatility 3 is the back-end you reach for when triage points at something.

What it does today

  • Auto-detects the OS from dump content (Windows kernel CodeView / Linux banner).
  • pslist — walks ActiveProcessLinks with PDB-exact offsets.
  • psscan — pool-tag scan for _EPROCESS allocations.
  • psxview — the diff between the two.
  • pstree — parent/child hierarchy.
  • cmdline — command line via the PEB.
  • dlllist — loaded modules via the PEB loader data.
  • modscan / modules — kernel modules from pool and live list.
  • netscan — network endpoints (experimental).
  • taskscan — Linux task_struct scan (experimental).

See getting started for the engine internals and pslist vs psscan vs psxview for the cross-view technique that catches DKOM rootkits.

When you still want Volatility

ramparser is built for fast, private, in-browser triage. Reach for Volatility 3 when:

  • You need malfind to surface RWX regions backed by no file.
  • You want a timeliner CSV merged into a SuperTimeline.
  • You need to scan process memory with curated YARA rules.
  • You are working a Linux kernel with a non-default layout.
  • You need to dump a process for downstream static analysis.

For everything before that, the static web page is the lower-friction option.

Further reading