
memory-relocalloc
C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…

C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…

AI-first reverse-engineering toolkit: static analysis, SSA decompiler, live memory, provenance. Source-available (PolyForm Noncommercial).

Object Pascal (Delphi) library for parsing, mapping, loading, and dumping Windows PE files, with relocations, imports, TLS, and remote process memory…

Windows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…

Cross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…

Reproducer and technical analysis for CVE-2026-85048, a Chrome viz surface use-after-free in the GPU process, with ASAN unit tests and browser…

Simple Process Dumper using DMA over a PCIe FPGA device

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…

A revival of the classic and legendary KsDumper

Community-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…

Abuses macOS debugger entitlements and DYLD_INSERT_LIBRARIES to dump or search a running process's memory while shifting EDR attribution to a signed…

Network forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…

Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely

Offensive token-harvesting utility that searches x64 process memory and TokenBroker cache files for Azure AD/O365 JWT tokens across Office, Edge,…

truffleproc — hunt secrets in process memory (TruffleHog & gdb mashup)

A python script developed to process Windows memory images based on triage type.

Visualize the virtual address space of a Windows process on a Hilbert curve.

Dump cookies and credentials directly from Chrome/Edge process memory