#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
jeanextreme002/pymemoryeditorA pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
pwndbg/pwndbgExploit Development and Reverse Engineering with GDB & LLDB Made Easy
mandiant/flare-flossFLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
angr/angrA powerful and user-friendly binary analysis platform!
nationalsecurityagency/ghidraGhidra is a software reverse engineering (SRE) framework
sneakynachos/cve-2026-84118-who-labeled-the-crit-as-a-highProof-of-concept for CVE-2026-84118, a SpiderMonkey GC use-after-free leading to out-of-bounds read/write and potential code execution. Includes…
pubglite55/oppo-ghostlockOPPO Find N2 GhostLock (CVE-2026-43499) exploit adaptation
kevoreilly/capev2Malware Configuration And Payload Extraction
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
radareorg/radare2UNIX-like reverse engineering framework and command-line toolset
liverwortenuresis371/copyfail-rsExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.
