
Nemesis
.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.

.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)

Finding secrets in kernel and user memory

EDRSandblast-GodFault

Differential Analysis of Malware in Memory

It encrypts the text section and set the protection to NO_ACCESS.

Mimikatz implementation in pure Python

Utility to find AES keys in running processes

A memory-based evasion technique which makes shellcode invisible from process start to end.

Linux Memory Cryptographic Keys Extractor

PoC and technical details of CVE-2025-24204

Reverse-engineered Easy Anti-Cheat kernel driver bypass that intercepts memory allocation to suppress violation packets, with report decryption…