ImHex
werwolv/imhex🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
binary-analysisdata-recoverydebuggers+8
54.5k
werwolv/imhex🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
dnspyex/dnspyUnofficial revival of the well known .NET debugger and assembly editor, dnSpy
mandiant/flare-vmA collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
zodiacon/alltoolsAll reasonably stable tools
carmaa/inceptionInception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard,…
ricardojoserf/trickdumpDump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!
mohuihui/antispyAntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and…
hasherezade/mal_unpackRuns packed malware in a controlled environment, waits for self-unpacking, dumps PE files and shellcodes from memory, and terminates the process.
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
ccob/beaconeyeHunts out CobaltStrike beacons and logs operator command output
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
mrt4ntr4/ntwardenWindows Analysis and Research Toolkit
theflink/deepsleepA variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
halpomeranz/lmgScript for automating Linux memory capture and analysis
jeanextreme002/pymemoryeditorA pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .
trailofbits/mquireZero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
anvilsecure/ulexecveExecutes arbitrary ELF binaries directly from memory on Linux without touching disk, enabling stealthy red-teaming and anti-forensic operations via a…