aether
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
binary-analysiscommand-and-controldigital-forensics+7
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
thalium/iceboxVirtual Machine Introspection, Tracing & Debugging
amossys/memitmTool to make in memory man in the middle
mxmssh/drltraceDrltrace is a library calls tracer for Windows and Linux applications.
buzzer-re/shinigamiA dynamic unpacking tool
secrary/drsemuDrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
0x742/noiaWeb-based tool for browsing mobile application sandboxes, previewing SQLite databases and binary files, and downloading app data via Frida…
kaisonox/apiscopeAn API hooking framework for intercepting and monitoring Windows applications
tracebyte8/systraceLinux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…
brandon7cc/mac-monitorAdvanced macOS system monitor leveraging Apple Endpoint Security to collect, enrich, and display process, file, memory, and XPC events for malware…
enkomio/thematrixa PE Loader and Windows API tracer. Useful in malware analysis.
egkritsis/cve-2025-61303Critical Vulnerability (9.8) - RecordedFuture Triage dynamic analysis engine can fail to record malicious behavior when samples produce very…
ohjeongwook/shellcodeemulatorShellcode emulator written with Unicorn Framework With Process Dump Emulation Environment
zypherion-technologies/nemesis.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
googleprojectzero/tinyinstA lightweight dynamic instrumentation library
bcoles/rootkit-signal-hunterDetect Linux rootkits which use signals to elevate process privileges.
almkuznetsov/cve-2024-1441Reproduces fuzzing and crash analysis for CVE-2024-1441 using AFL++ and CASR, with detailed setup and commands for libvirt.
afshinm/zeroboxLightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.