Awesome GitHub RepositoriesMemory Forensics

This project is a security tool installation framework and binary analysis toolkit designed to automate the deployment of research utilities. It provides a containerized security research environment and a system for managing Python and Ruby virtual environments to prevent dependency conflicts on the host machine. The framework distinguishes itself through a structured tool catalog and provisioning scripts that automate the installation of utilities into isolated directories. It utilizes executable symlink mapping to provide a unified command interface and supports the bootstrapping of consis

Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com

pcileech is a toolkit for executing DMA attacks, analyzing PCIe bus traffic, performing kernel patching, and conducting remote volatile memory forensics. It functions as a hardware memory acquisition tool and a PCIe DMA attack framework designed to read and write remote system memory via direct hardware interfaces. The project provides capabilities for capturing and displaying raw transaction layer packets from the PCIe bus and mounting live RAM as local drives for analysis. It enables the modification of system memory signatures and the execution of shellcode or implants within the kernel wi

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

This project is a curated collection of tools, scripts, and technical guides designed to enhance offensive security operations using Cobalt Strike. It serves as a resource hub for managing command and control infrastructure and deploying security engagements. The collection includes toolkits for evading endpoint detection and response systems, alongside libraries for automating red team tasks such as reconnaissance and host enumeration. It provides resources for developing post-exploitation frameworks, specifically focusing on the creation of reflective libraries and memory-resident code. Th

MemProcFS est un outil d'analyse de mémoire volatile et un système d'acquisition de mémoire multiplateforme. Il fonctionne comme un système de fichiers virtuel de forensique mémoire, mappant la mémoire physique et les objets du noyau dans une structure de répertoire virtuelle qui permet aux utilisateurs d'analyser les artefacts système en utilisant des outils de système de fichiers standard. Le projet se distingue en fournissant un système de fichiers virtuel pour la forensique mémoire, permettant de parcourir et d'interroger la mémoire physique comme des fichiers et dossiers en lecture seule. Il intègre également un scanner de mémoire basé sur Yara pour identifier les signatures de logiciels malveillants et le code injecté au sein de la mémoire physique. Le moteur couvre un large éventail de capacités forensiques, incluant l'inspection des processus et des threads, la liste des connexions réseau et l'analyse du registre Windows. Il prend en charge l'ingestion de données à partir de systèmes en direct, de crash dumps et de machines virtuelles, tout en fournissant une résolution de symboles pour traduire les adresses mémoire brutes en noms significatifs. L'intégration est prise en charge via une interface programmatique multi-langage et des wrappers de bibliothèque native pour C et Java, ainsi qu'un scripting Python headless pour les workflows automatisés.

Volatility3 est un framework de forensique mémoire et un outil d'analyse utilisé pour analyser les dumps de mémoire volatile. Il extrait des artefacts numériques et reconstruit l'état d'exécution d'un système pour récupérer des informations sur les processus, des artefacts réseau et d'autres preuves forensiques. Le système fonctionne comme un moteur forensique basé sur des plugins et un résolveur de symboles de système d'exploitation. Il mappe les adresses mémoire brutes aux structures système connues en utilisant des tables de symboles et des couches de traduction, et fournit une architecture extensible pour créer des scanners et des rendus personnalisés. Le framework inclut un explorateur de mémoire en ligne de commande pour la découverte de données en temps réel et une interface programmable pour automatiser la génération de rapports mémoire. Il gère l'extraction d'artefacts numériques et la résolution de symboles système via un processus de traduction d'adresses par couches.

MimiPenguin est un extracteur de références de mémoire Linux et un outil de récupération de mot de passe conçu pour isoler et récupérer les mots de passe de connexion utilisateur en texte clair à partir de la mémoire de processus active. Il fonctionne comme un utilitaire de post-exploitation pour extraire des références sensibles des sessions utilisateur de bureau lors d'évaluations de sécurité. L'outil effectue une analyse forensique de la mémoire Linux en analysant la mémoire des processus système pour identifier et isoler les références. Il est utilisé pour les tests d'intrusion de sécurité et l'évaluation des risques associés aux attaques basées sur la mémoire, ainsi que pour tester l'élévation de privilèges locale. Le système cible la mémoire de session utilisateur en vidant la mémoire virtuelle des processus en cours d'exécution. Il utilise une analyse de mémoire basée sur des motifs, une identification heuristique des mots de passe et une isolation des références en texte clair pour distinguer les mots de passe potentiels des données binaires.

Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

Chainsaw is a Windows forensic analysis tool used for parsing system databases and extracting security artefacts. It functions as a forensic artefact extractor and a scanner for identifying security threats and log tampering within Windows event logs. The project distinguishes itself by implementing a Sigma rule forensic scanner that applies standardized detection logic and custom rule sets to event logs and forensic artefacts. It enables threat hunting workflows by matching event data against patterns to identify malicious activity, lateral movement, and brute force attacks. The tool's capa

ipsw is a specialized toolkit for iOS firmware analysis, binary reverse engineering, and hardware interaction. It provides a suite of tools for downloading, extracting, and analyzing firmware images and kernel caches, alongside a MachO binary analysis tool for disassembling and patching executables. The project distinguishes itself through integrated language-model-powered code reconstruction to translate machine code into high-level source code. It also features an automation client for the App Store Connect API to manage certificates and application settings. The framework covers a broad r

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe