
pwndbg
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

A PowerShell Module Dedicated to Reverse Engineering

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners…

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

A curated collection of DFIR skills and workflows for InfoSec practitioners.

ROP-based sleep obfuscation to evade memory scanners

:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.

Memoro: A Detailed Heap Profiler

Enumerate various traits from Windows processes as an aid to threat hunting


Platform security assessment tool for dumping and analyzing UEFI/SMM registers, PCI config space, physical memory, SPI flash, and S3 bootscripts with…

针对(CVE-2023-0179)漏洞利用 该漏洞被分配为CVE-2023-0179,影响了从5.5到6.2-rc3的所有Linux版本,该漏洞在6.1.6上被测试。 漏洞的细节和文章可以在os-security上找到。

Technical analysis and proof-of-concept exploit for CVE-2023-28252, a Windows Common Log File System (CLFS) driver privilege escalation vulnerability…

A Windows kernel dump C++ parser library with Python 3 bindings.