#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
velocidex/linpmemLinux kernel driver for physical memory acquisition, enabling read access to any physical address including reserved memory and memory holes, with…
kacperszurek/gpg_reaperGPG Reaper - Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory
kuwaitist/astral_projectionCobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…
tandasat/cve-2023-36427Report and exploit of CVE-2023-36427
piat0n/baremetal-ram-dumperA bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.
zhuowei/apple-positional-audio-codec-invalid-headerCVE-2025-31200 - @Noahhw46 figured it out
controlplaneio/truffleproctruffleproc — hunt secrets in process memory (TruffleHog & gdb mashup)
hunters-sec/cve-2025-43300This is POC for IOS 0click CVE-2025-43300
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
jir4vv1t/cve-2025-43529Technical exploit for CVE-2025-43529, a WebKit DFG JIT compiler vulnerability enabling use-after-free via missing store barrier in concurrent GC,…
ekknod/amdryzenmastercheatExploit tool leveraging CVE-2020-12928 (AMD RyzenMaster driver) for game memory manipulation and anti-cheat bypass on Windows 10 with AMD Ryzen CPUs.
opensourcesec/cirtkitTools for the Computer Incident Response Team :computer:
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
idov31/etwleakkernelLeaking kernel addresses from ETW consumers. Requires Administrator privileges.
ttffdd/xbadmannersTool for CVE-2018-16323
sydsec/sydOffline AI Security Assistant for Air-Gapped Pentesting
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
