miniDumpReader
gmh5225/minidumpreaderParses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…
memory-forensicsforensicsmalware-analysis+3
gmh5225/minidumpreaderParses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…
gmh5225/memtoolsWindows Linux DMA、Dump 、Direct、inject 内存读取、写入工具
gmh5225/mapped-dumperA program written in C++ for remotely dumping manual mapped modules.
woldann/exoprocCross-process instrumentation for Windows x64 in TypeScript — hook functions, redirect threads, and read/write memory in another process, with no DLL…
gmh5225/lithium-kernelWindows kernel-mode driver with user-mode client exposing IOCTL-based physical and virtual memory read/write, page table walking, pattern scanning,…
vmoranv/jshookmcpA search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.
gmh5225/linux-kernel-debuggerKernel hardware debugger module for dumping rootkit operations and inspecting kernel-level activity for malware analysis and reverse engineering.
gmh5225/kernelmode-driverKernel Driver for x64 Window System which allows you to read/write Virtual/Physical Memory hooking Win32k
frida/frida-gumCross-platform instrumentation and introspection library written in C
xf1les/fsop-finderBinary Ninja plugin that scans glibc libio for FSOP code paths capable of hijacking control flow and stack pointer, aiding heap exploitation research.
structio-labs/n0xisAI-first reverse-engineering toolkit: static analysis, SSA decompiler, live memory, provenance. Source-available (PolyForm Noncommercial).
habanada/nativepeObject Pascal (Delphi) library for parsing, mapping, loading, and dumping Windows PE files, with relocations, imports, TLS, and remote process memory…
pdb333/cortexA Windows runtime analysis toolkit combining memory scanning, debugging, automation, and AI-friendly APIs.
akatorich/kernelflirtWindows kernel-level debugger with OllyDbg/IDA-style UI, software and hardware breakpoints, PDB symbols, decompiler, and 17 plugins for reverse…
qsecure-labs/deadmatterOffset Independent Credential Extraction Tool
hasamba/dfir-companionDFIR forensics companion server + capture extension
gmh5225/frida-il2cpp-datacollectorFrida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…