
GoReSym
Parses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…

Parses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…

Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks



Finding secrets in kernel and user memory

Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring

Easy-to-use live forensics toolbox for Linux endpoints

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

RAM imaging utility.

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and…

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

A forensic evidence collection & analysis toolkit for OS X

Distributed & real time digital forensics at the speed of the cloud

Graph platform for Detection and Response

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…