Memory Forensics

maldev-academy/dumpbrowsersecrets

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from…

memn0ps/matrix-rs

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

dbrant/bios_memimage

RAM imaging utility.

504ensicslabs/damm

Differential Analysis of Malware in Memory

soteria-research/cve-2015-4843-type-confusion-phrack

Demonstrates type confusion and heap overflow exploits for CVE-2015-4843 in Java, with demos for aarch64 and Morello, highlighting CHERI capability…

0vercl0k/cve-2022-21974

PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"

0vercl0k/cve-2022-21971

PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

0vercl0k/cve-2021-32537

PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.

jamf/cve-2020-1206-poc

CVE-2020-1206 Uninitialized Kernel Memory Read POC

yelparchive/osxcollector

A forensic evidence collection & analysis toolkit for OS X

mandiant/silketw

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

dnspy/dnspy

.NET debugger and assembly editor

cado-security/varc

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use…

gabriellandau/edrsandblast-godfault

EDRSandblast-GodFault

daddycocoaman/dumpscan

Finding secrets in kernel and user memory

cado-security/rip_raw

Rip Raw is a small tool to analyse the memory of compromised Linux systems.