#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
renukaselvar/libunwind_cve-2015-3239_afterLibrary for unwinding processor call stacks, supporting multiple architectures and operating systems, with build and regression testing instructions.
sneakynachos/cve-2026-84118-who-labeled-the-crit-as-a-highProof-of-concept for CVE-2026-84118, a SpiderMonkey GC use-after-free leading to out-of-bounds read/write and potential code execution. Includes…
ymsniper/umbraExternal read-only game overlay for Linux. Derived offsets, composed skeletons, optional kernel module for ptrace-independent memory reads and…
dnspy/dnspy.NET debugger and assembly editor
volatilityfoundation/volatilityAn advanced memory forensics framework
hluwa/frida-dexdumpA frida tool to dump dex in memory to support security engineers analyzing malware.
yelparchive/osxcollectorA forensic evidence collection & analysis toolkit for OS X
cisco-talos/pyreboxPython scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU
blackberry/pe_treePython module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…
mozilla/migDistributed & real time digital forensics at the speed of the cloud
itm4n/ppldumpDump the memory of a PPL with a userland exploit
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
memn0ps/matrix-rsRusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)
ivan-sincek/invokerPenetration testing utility and antivirus assessment tool.
0vercl0k/cve-2022-21971PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"
gabriellandau/edrsandblast-godfaultEDRSandblast-GodFault
