dissect
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
data-recoverydigital-forensicsdisk-forensics+5
1.2k
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
nour833/stegoforgeThe ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…
kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
mandiant/flare-flossFLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
dougwithseismic/dezlock-dumpRuntime schema + RTTI extraction tool for Deadlock, CS2, Dota, and others (Source 2). No source2gen required.
microsoft/procdump-for-linuxA Linux version of the ProcDump Sysinternals tool
structio-labs/n0xisAI-first reverse-engineering toolkit: static analysis, SSA decompiler, live memory, provenance. Source-available (PolyForm Noncommercial).
karollooool/cve-2026-50416-writeup-and-pocCVE-2026-50416: Windows 11 KASLR bypass
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
zypherion-technologies/nemesis.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
ledlight33/copyfail-dfirInteractive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
0xblackash/cve-2026-74469Research repository for CVE-2026-74469 (DiagSpill), a Linux kernel SCTP peer transport counter overflow causing an out-of-bounds write, with PoC,…
jssngc/ontheedgeWindows research PoC in C that scans Microsoft Edge process memory for credential-related data, with a standalone executable and a BOF variant for C2…
sneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counterChrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer.