#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
fortra/nanodumpThe swiss army knife of LSASS dumping
lethal-forensics/collect-memorydumpAutomated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…
anvilsecure/ulexecveExecutes arbitrary ELF binaries directly from memory on Linux without touching disk, enabling stealthy red-teaming and anti-forensic operations via a…
sterrasec/apk-meditmemory search and patch tool on debuggable apk without root & ndk
zypherion-technologies/nemesis.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
darthton/blackboneWindows memory hacking library
kudaes/rustchainHide memory artifacts using ROP and hardware breakpoints.
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
ricardojoserf/trickdumpDump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!
t-tani/yama-devYet Another Memory Analyzer for malware detection
kudaes/shelterROP-based sleep obfuscation to evade memory scanners
xre0us/multidumpMultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly.
ricardojoserf/nativedumpDump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)
nightbringer21/fridumpCross-platform memory dumper using Frida to extract accessible memory from iOS, Android, and Windows applications for forensic analysis and…
mayhamad/memtracerLive memory analysis tool for detecting reflectively loaded .NET DLLs by scanning process memory regions for abnormal flags, page types, and PE…
velocidex/linpmemLinux kernel driver for physical memory acquisition, enabling read access to any physical address including reserved memory and memory holes, with…
tastypepperoni/pplbladeBypasses PPL protection to dump LSASS process memory, obfuscates dump files with XOR, and exfiltrates them remotely via RAW or SMB without writing to…
naksyn/moduleshiftingStealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes
