
libunwind_CVE-2015-3239_After
Library for unwinding processor call stacks, supporting multiple architectures and operating systems, with build and regression testing instructions.

Library for unwinding processor call stacks, supporting multiple architectures and operating systems, with build and regression testing instructions.


helps visualize heap operations for pwn and debugging

Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.

A python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.

Experimental kernel-mode EDR research project focused on explainable detection of suspicious in-memory execution patterns, producing human-readable…

Detection reverse shell and kill it before trying shell.

SLUBStick exploitation of CVE-2022-2588. Converting a DF into a cross-cache arbitrary memory R/W primitive through PTE manipulation.

Binary Ninja plugin that scans glibc libio for FSOP code paths capable of hijacking control flow and stack pointer, aiding heap exploitation research.

Open source memory scanner written in C++

This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created,…

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators…

Java Agent memory horse scanner combined with Call Graph modus

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

A BOF designed to inspect processes memory and addresses

A little tool to play with the Seclogon service

Kernel hardware debugger module for dumping rootkit operations and inspecting kernel-level activity for malware analysis and reverse engineering.

GPG Reaper - Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory