forrest-orr/artifacts-kitPseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
darthton/blackboneWindows memory hacking library
hugsy/gefGEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
monoxgas/srdiShellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
thewover/donutGenerates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs…
hasherezade/libpeconvCustom PE loading and manipulation library for manual mapping, IAT hooking, memory dumping, and rebuilding imports for malware analysis and reverse…
lem0nsec/shellghostA memory-based evasion technique which makes shellcode invisible from process start to end.
mgeeky/threadstackspooferThread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners…
codewhitesec/handlekatzPIC-based Lsass memory dumper using cloned handles to evade detection, producing obfuscated dumps with minimal memory footprint for red team…
blacksnufkin/novaldrThreadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre)
winterknife/evenstarIntel 64/Windows low-level experiments
ntdallas/bof_runpeBOF to run PE in Cobalt Strike Beacon without console creation
airbus-cert/yara-ttdUse YARA rules on Time Travel Debugging traces
kuwaitist/astral_projectionCobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…
iss4cf0ng/ironpeRust-based Windows PE manual loader that maps and executes x86/x64 executables from memory, demonstrating internal loader behavior and PE structure…
