
frida-medit
Cross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…

Cross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…

Volatility 3 ported to Rust. Same output, much faster.

Volatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.

Scripts for extracting useful information from infected memory dumps

YARA rule and python script to detect potential exploits for the CVE-2026-21509 vulnerability in MS Office


A python script developed to process Windows memory images based on triage type.

machofile is a module to parse Mach-O binary files

A repository hosting example goodware evtx logs containing sample software installation and basic user interaction

PowerShellProfiler

Tools to enumerate Windows Firewall Hook Drivers on Windows 2000, XP and 2003

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

Tool to help guess a files 256 byte XOR key by using frequency analysis

Contains tools to perform malware and forensic analysis in Memory


Software to identify the different types of hashes -

Parsing Ramnit's traffic
