Cold Coffee Memory Forensics

Resolve runtime addresses and structures from evidence, then produce repeatable tooling.

Start

1. Establish architecture, pointer width, endianness, target OS/runtime, and artifact type.
2. Distinguish absolute addresses, module-relative offsets, signatures, pointer chains, handles, and generated references.
3. Record module mappings, page protections, thread/heap context, and address provenance.
4. Use scripts/aob_scan.py for wildcard byte-pattern scans and scripts/dump_strings.py for offset-aware ASCII/UTF-16 extraction.

Select references

• Windows live process, dumps, WinDbg, RPM/WPM: read references/windows.md.
• Linux, Android, Frida, IL2CPP: read references/linux-android.md.
• Raw dumps, structures, pointer chains, memory forensics: read references/dump-structures.md.

Execute

• Prefer module resolution, signatures, and validated pointer paths over hard-coded absolute addresses.
• Use controlled state changes, memory diffs, watchpoints, allocation hooks, and access-width patterns to recover structures.
• Verify readable/writable regions and bounds before access.
• For patches, capture original bytes, validate expected bytes, restore protections, and provide rollback.

Deliver

Return the address derivation, mapping evidence, recovered structure, complete reader/scanner/hook/patch code, error handling, logs, and verification steps.