MEMLABS memory forensic challenges


MemoryForensic website aims to be the #1 website on the Internet for anyone who wants to learn and be adept in memory forensics field. Thus, we must list valuable resources that already exist, but people may not aware of. One of these resources is MEMLABS.


This work is done by Abhiram Kumar, and this article is based on his work

About MemLabs

MemLabs is an educational series of challenges styled after Capture The Flag (CTF), designed to inspire students, security enthusiasts, and CTF players to delve into the realm of Memory Forensics.

Labs’ Structure

DirectoryChallenge NameLevel Of DifficultyLink
Lab 0Never Too Late MisterSample challengeDownload
Lab 1Beginner’s LuckEasyDownload
Lab 2A New WorldEasyDownload
Lab 3The Evil’s DenEasy – MediumDownload
Lab 4ObsessionMediumDownload
Lab 5Black TuesdayMedium – HardDownload
Lab 6The ReckoningHardDownload
Memory Forensic Images & corresponding difficulty

Start with Lab 0 (sample with solution) to know more about the usage of Volatility and better understand the analysis logic, then go further~

 Note: All the memory dumps are Windows-based.

Tools and frameworks

I’d suggest everyone use The Volatility Framework for analysing the memory images.

Please execute the file to install all the required dependencies in your system.

Note: Windows users can download the executable file from here.

As these labs are quite introductory, there is no need for installing more tools. However, if the user wishes, they can install many other forensic tools.

The preferred OS would be Linux. However, you can also use Windows (WSL) or macOS.

Flag submission

Please send the flags for each lab to

Please refer to the example below to understand how to submit your solution.

Suppose you discover 3 flags in a specific lab:

  • flag{stage1_is_n0w_d0n3}
  • flag{stage2_is_n0w_d0n3}
  • flag{stage3_is_n0w_d0n3}

Concatenate all the flags like this: flag{stage1_is_n0w_d0n3} flag{stage2_is_n0w_d0n3} flag{stage3_is_n0w_d0n3}

Ensure the flags are arranged in the correct order, and separate them with spaces. The content within the flags indicates their position.

Email format & Successful Submission

Please follow the following guidelines when sending the solution. Below is a sample:

Email Subject: [MemLabs Solution Submission] [Lab-x]

x indicates the Lab number. Ex: 1,2,3 etc..


Email your solution to

If the solution is correct, then the participant will receive a confirmation mail.


MemLabs is a memory forensics learning series put in a ctf-style challenges, where you can learn and enhance your memory analysis skills.

~ Cya till the next one 🙂

Leave a Reply