
pyrebox
Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

truffleproc — hunt secrets in process memory (TruffleHog & gdb mashup)

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…


Parses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…

Incident Response & Digital Forensics Debugging Extension

Lightweight Windows disassembler, PE inspection and patch-assistance tool for native EXE/DLL files.

Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…

Reverse engineering analysis of Formbook, an info-stealer that uses .NET assembly manipulation and XOR decryption. Full payload extracted via x32dbg,…

Windows Linux DMA、Dump 、Direct、inject 内存读取、写入工具

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

Rust port of REA, a local-only reverse-engineering tool with CLI/MCP workflows and a native Ghidra worker

Use Prolog to analyze memory dumps and stopped live processes in WinDbg.