pe-sieve
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
binary-analysisforensicsmalware-analysis+2
3.9k
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
volatilityfoundation/volatilityAn advanced memory forensics framework
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
marcosd4h/memhunterLive hunting of code injection techniques
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
withsecurelabs/volatility-pluginsVolatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.
504ensicslabs/dammDifferential Analysis of Malware in Memory
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
jajangjaman/cve-2021-41160FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server…
sandi-go/cve-2018-12798Proof-of-concept exploit for CVE-2018-12798, a heap overflow in Adobe Acrobat Reader that enables remote code execution via malicious PDF files.
nonameerror/mongobleed---cve-2025-14847-poc-This repo contains my python script version of CVE-2025-14847 (MongoBleed)
hwbp/ntdll-unhookproper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.
volatilityfoundation/communityCommunity-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…
gmh5225/memory-relocallocC proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…