#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
epasveer/seerSeer - a gui frontend to gdb
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
skelsec/pypykatzMimikatz implementation in pure Python
paboldin/meltdown-exploitMeltdown Exploit PoC
simsong/bulk_extractorThis is the development tree. Production downloads are at:
orlyjamie/mimikittenzA post-exploitation powershell tool for extracting juicy info from memory.
dynamorio/drmemoryMemory Debugger for Windows, Linux, Mac, and Android
fortra/nanodumpThe swiss army knife of LSASS dumping
apple-oss-distributions/xnuHybrid kernel combining Mach, FreeBSD, and IOKit for macOS and iOS. Provides core OS services, driver framework, and security policy enforcement on…
hasherezade/libpeconvCustom PE loading and manipulation library for manual mapping, IAT hooking, memory dumping, and rebuilding imports for malware analysis and reverse…
p1sec/qcsuperQCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames, among other things.
jtsylve/limeKernel module for volatile memory acquisition from Linux and Android devices, producing forensically sound captures to disk or over the network.
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
awnumar/memguardSoftware sandbox for storage of sensitive information in memory.
reclassnet/reclass.netMore than a ReClass port to the .NET platform.
qi4l/jysoDual-purpose JNDI injection and Java deserialization exploitation framework with advanced bypass capabilities for WAF, RASP, and high JDK versions.…
