
NativeMirror
Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Offset Independent Credential Extraction Tool

Frida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…

Simple Process Dumper using DMA over a PCIe FPGA device

Volatility 3 ported to Rust. Same output, much faster.

Retrieves the master password from Keepass memory dump, using a hint of bruteforce.

Volatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.

Collection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…

Curated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

List of Awesome CobaltStrike Resources

Visualize the virtual address space of a Windows process on a Hilbert curve.

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

Enumerate various traits from Windows processes as an aid to threat hunting


RansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…

Dump TeamViewer ID and password from memory. Works much better than other tools.

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…