
invoker
Penetration testing utility and antivirus assessment tool.

RAM imaging utility.

EDRSandblast-GodFault

PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

Easy-to-use live forensics toolbox for Linux endpoints

Dump the memory of a PPL with a userland exploit

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

Distributed & real time digital forensics at the speed of the cloud

Volatility 3 plugin that carves MCP/JSON-RPC message candidates from Windows and Linux memory dumps, preserving raw bytes, addresses, and SHA-256 for…

Proof-of-concept demos and libkdump library demonstrating the Meltdown microarchitectural attack, leaking kernel and physical memory on vulnerable…

ASLR-independent nginx RCE chain PoC combining the PoolSlip heap over-read leak (CVE-2026-9256) with the rift overflow (CVE-2026-42945) to reach…

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use…

PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.

CVE-2020-1206 Uninitialized Kernel Memory Read POC

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"

PoC that extracts the Google Password Manager Security Domain Secret from Chrome process memory and decrypts synced GPM passkey ECDSA P-256 private…