
TrueTree
A command line tool for pstree-like output on macOS with additional pid capturing capabilities

A command line tool for pstree-like output on macOS with additional pid capturing capabilities

Command line tool for scanning streams within office documents plus xor db attack

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.

Windows link file (shortcuts) examiner

machofile is a module to parse Mach-O binary files

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

Detection Script for MongoBleed Exploitation

Utility for recovering ES File Explorer encrypted files (.eslock)

Detection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303