
x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.


Master's thesis research on CVE-2021-4034 (PwnKit) local privilege escalation. Multi-payload Python exploit with 7 modes including interactive shell,…

Virtual Machine Introspection, Tracing & Debugging

Finding secrets in kernel and user memory

Runtime JVM analysis toolkit for inspecting classes, methods, fields, constant pool, and bytecode

This tool demonstrates CVE-2026-38194, a vulnerability in Teledyne Digital Imaging Sapera Memory Manager (v9.0.0.0 and below). The CORMEM.SYS kernel…

Simple Process Dumper using DMA over a PCIe FPGA device

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…

Dump LSASS via physical memory read primitives in vulnerable kernel drivers

Visualize the virtual address space of a Windows process on a Hilbert curve.

volatility explorer (volatility 2)

Windows kernel-mode driver with user-mode client exposing IOCTL-based physical and virtual memory read/write, page table walking, pattern scanning,…

Cobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…

Memory API proxy via signed mozglue.dll

Exploit for CVE-2026-46215, a Linux kernel DRM GEM use-after-free local privilege escalation. Uses racing, slab spraying, and Dirty Pipe-style file…

Proof-of-concept exploit for CVE-2020-27949, demonstrating arbitrary memory read/write in macOS processes via DTrace fasttrap ioctl without elevated…

CVE-2026-50416: Windows 11 KASLR bypass