Memory Forensics

harryanon/r0ak

Windows command-line utility for reading, writing, and executing kernel-mode code from Administrator context using a font validation execution…

cornerpirate/java-stager

A PoC Java Stager which can download, compile, and execute a Java file in memory.

nickcano/xenoscan

Open source memory scanner written in C++

paolomonti42/salt

SALT - SLUB ALlocator Tracer for the Linux kernel

enkomio/shed

.NET runtime inspector

hasherezade/pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

rabbitstack/fibratus

Security sensor for realtime threat detection and protection

amossys/memitm

Tool to make in memory man in the middle

cheat-engine/cheat-engine

Cheat Engine. A development environment focused on modding

opensourcesec/cirtkit

Tools for the Computer Incident Response Team :computer:

rek7/mxtract

mXtract - Memory Extractor & Analyzer

mattifestation/powershellarsenal

A PowerShell Module Dedicated to Reverse Engineering

mlcsec/proctools

Small toolkit for extracting information and dumping sensitive strings from Windows processes

blacksnufkin/novaldr

Threadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre)

angr/angr

A powerful and user-friendly binary analysis platform!

nationalsecurityagency/ghidra

Ghidra is a software reverse engineering (SRE) framework