
AllTools
All reasonably stable tools

All reasonably stable tools

Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

Dump cookies and credentials directly from Chrome/Edge process memory

Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!


Incident Response Triage - Windows Evidence Collection for Forensic Analysis

Tools for the Computer Incident Response Team :computer:

Offset Independent Credential Extraction Tool

A BOF designed to inspect processes memory and addresses

"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…

Demonstrates cleartext storage of license keys in memory in Abacre Restaurant POS, enabling license activation bypass via debugger and memory dump…

Simulation-only proof of concept for CVE-2026-99999, a Linux kernel virtio-net IPv4 csum_start validation bug enabling guest-to-host heap memory…

A post-exploitation powershell tool for extracting juicy info from memory.

Portable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…

Proof-of-concept exploit for CVE-2025-14847, a MongoDB zlib decompression vulnerability that leaks uninitialized server memory via crafted BSON…

Cross-platform memory dumper using Frida to extract accessible memory from iOS, Android, and Windows applications for forensic analysis and…


mXtract - Memory Extractor & Analyzer