Memory Forensics

anvilsecure/ulexecve

Executes arbitrary ELF binaries directly from memory on Linux without touching disk, enabling stealthy red-teaming and anti-forensic operations via a…

attackercan/teamviewer-dumper

Dump TeamViewer ID and password from memory. Works much better than other tools.

fortra/cve-2023-28252

Technical analysis and proof-of-concept exploit for CVE-2023-28252, a Windows Common Log File System (CLFS) driver privilege escalation vulnerability…

codewhitesec/unmarshalpwn

POC for CVE-2018-0824

naksyn/moduleshifting

Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes

0xpoly/centry

Panic button for protection against cold boot attacks

0vercl0k/kdmp-parser

A Windows kernel dump C++ parser library with Python 3 bindings.

0vercl0k/clairvoyance

Visualize the virtual address space of a Windows process on a Hilbert curve.

bohops/rogueassemblyhunter

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.

daffainfo/vol-rs

Volatility 3 ported to Rust. Same output, much faster.

packtpublishing/learning-linux-binary-analysis

Learning Linux Binary Analysis, published by Packt

ajmartel/irtriage

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

la3ar0v/tuxresponse

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

memoryforensics1/volexp

volatility explorer (volatility 2)

volatilityfoundation/dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON

trolldbois/python-haystack

Process heap analysis framework - Windows/Linux - record type inference and forensics