
Centry
Panic button for protection against cold boot attacks

Panic button for protection against cold boot attacks

SentinelNav: zero-dependency, pure Python binary visualization and forensics tool.

Stealthy In-Memory Local Password Harvester (SILPH) tool: dump LSA, SAM and DCC2 with indirect syscall

ML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…

A Generic Windows Memory Scraping Tool

A Runtime Crypter in C for Linux ELF binaries.

Exploit for AMD SEV-SNP firmware vulnerability CVE-2024-21978, enabling decryption of arbitrary guest memory via memory corruption of context pages.

Exploit for AMD SEV-SNP firmware vulnerability (CVE-2023-31355) that decrypts arbitrary memory of decommissioned guests by corrupting the UMC key…

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

This is the development tree. Production downloads are at:

The swiss army knife of LSASS dumping


An Active Defense and EDR software to empower Blue Teams

Windows Analysis and Research Toolkit

mXtract - Memory Extractor & Analyzer

Bypasses PPL protection to dump LSASS process memory, obfuscates dump files with XOR, and exfiltrates them remotely via RAW or SMB without writing to…

Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes