The Existing memory acquisition device type is a pseudo type. Sometimes there a need to attach to an already existing LeechCore instance.

An example is a program with an already initialized LeechCore via MemProcFS. To get the LeechCore handle it's possible to specify -device existing.

The existing device type may also be used in conjunction with the LeechAgent to attach to already on-going sessions.

LeechCore API:

Please specify the acquisition device type in LC_CONFIG.szDevice when calling LcCreate. The acquisition device type is existing.

PCILeech / MemProcFS:

Please specify the device type in the -device option to PCIleech/MemProcFS.

Examples:

-device existing

No additional requirements exist.