How emadabedini/dumplyzer works
Dumplyzer is a local-first desktop memory-forensics workbench. An analyst imports a memory image, selects guided or custom analysis, and explores persisted process, network, memory, finding, IOC, and timeline results before optionally running heavier extraction or signature tasks and exporting reports. The graph follows the documented frontend-to-local-engine design and the sampled server, job, coverage, and Volatility code; several analysis and bridge links reflect documented responsibilities rather than inspected call sites.
Main entry points: schema.py Artifact database · workflows.py Analysis workflows · App.tsx Investigation UI · api.ts Engine client
Components 21
Desktop workspace
- Investigation UI
app/frontend/src/App.tsx - Workspace views
app/frontend/src/components - Engine client
app/frontend/src/lib/api.ts - Desktop bridge
app/desktop/src/lib.rs
Engine orchestration
- Engine launcher
app/desktop/src/engine.rs - RPC server
engine/memscope_engine/server.py - Job manager
engine/memscope_engine/jobs/manager.py
Evidence analysis
- Analysis workflows
engine/memscope_engine/analysis/workflows.py - Process analysis
engine/memscope_engine/analysis/process_analysis.py - Network artifacts
engine/memscope_engine/analysis/network_artifacts.py - Plugin explorer
engine/memscope_engine/analysis/plugin_explorer.py - Specialized analyses
engine/memscope_engine/analysis
Investigation results
- Artifact database
engine/memscope_engine/storage/schema.py - Coverage derivation
engine/memscope_engine/analysis/coverage.py - Search and IOCs
engine/memscope_engine/analysis/search_iocs.py - Artifact store
engine/memscope_engine/artifacts/store.py - Report exports
engine/memscope_engine/export/workflows.py
Analysis integrations
- Volatility session
engine/memscope_engine/volatility/session.py - Local analysis tools
engine/memscope_engine/providers
Other components
- Analyst
- Memory image
Connections 24
- Analyst → Investigation UI: uses
- Memory image → Investigation UI: selects
- Investigation UI → Workspace views: renders
- Investigation UI → Engine client: requests
- Engine client → Desktop bridge: invokes
- Desktop bridge → Engine launcher: starts
- Engine launcher → RPC server: runs
- RPC server → Job manager: queues work
- RPC server → Analysis workflows: dispatches
- Analysis workflows → Volatility session: runs plugins
- Plugin explorer → Volatility session: runs plugins
- Volatility session → Memory image: reads
- Analysis workflows → Process analysis: calls
- Analysis workflows → Network artifacts: calls
- Job manager → Specialized analyses: dispatches
- Specialized analyses → Local analysis tools: uses
- Analysis workflows → Artifact database: persists
- Process analysis → Artifact database: persists
- Network artifacts → Artifact database: persists
- Specialized analyses → Artifact store: records
- Coverage derivation → Artifact database: reads runs
- Search and IOCs → Artifact database: searches
- Report exports → Artifact database: collects results
- Engine client → Workspace views: returns results