PTM
gmh5225/ptmC++ library for manipulating x86-64 paging tables from user mode: read/write PML4E, PDPTE, PDE and PTE entries, translate virtual to physical…
binary-exploitationexploitationmemory-forensics+3
3
gmh5225/ptmC++ library for manipulating x86-64 paging tables from user mode: read/write PML4E, PDPTE, PDE and PTE entries, translate virtual to physical…
kowntaewook/mcptraceVolatility 3 plugin that carves MCP/JSON-RPC message candidates from Windows and Linux memory dumps, preserving raw bytes, addresses, and SHA-256 for…
habanada/nativemirrorNative Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.
kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
gmh5225/no-access-protection-x86It encrypts the text section and set the protection to NO_ACCESS.
blendin/3snakeTool for extracting information from newly spawned processes
qsecure-labs/deadmatterOffset Independent Credential Extraction Tool
jssngc/ontheedgeWindows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…
0xblackash/cve-2026-74469Research repository for CVE-2026-74469 (DiagSpill), a Linux kernel SCTP peer transport counter overflow causing an out-of-bounds write, with PoC,…
sneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counterChrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer.
gmh5225/dma-processdumperSimple Process Dumper using DMA over a PCIe FPGA device
gmh5225/driver-pidqserializationwrite-exampleHow to use PiDqSerializationWrite. Introduces how to safely read and write from mapped driver
stephenfewer/reflectivedllinjectionReflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
amperclock/cve-2023-32784-kdbxpassdmpRetrieves the master password from Keepass memory dump, using a hint of bruteforce.
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
withsecurelabs/memory-carving-scriptsScripts for extracting useful information from infected memory dumps
ledlight33/copyfail-dfirInteractive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.