Awesome GitHub RepositoriesProcess Memory Scanners

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory. The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool th

Blackbone मेमोरी स्कैनिंग, प्रोसेस इंजेक्शन और कर्नल-ड्राइवर इंटरफेस के लिए विशेष टूल्स का एक संग्रह है, जिसका उपयोग Windows निष्पादन एनवायरनमेंट में हेरफेर करने के लिए किया जाता है। यह रिमोट कोड निष्पादित करने, पोर्टेबल निष्पादन योग्य इमेजेस को मैप करने और विभिन्न प्रोसेस सीमाओं के बीच थ्रेड्स को मैनेज करने के लिए एक फ्रेमवर्क प्रदान करता है। इस प्रोजेक्ट में कर्नल मेमोरी तक पहुंचने और यूजर-मोड डिटेक्शन से एलोकेशन को छिपाने के लिए हैंडल अधिकारों को संशोधित करने के लिए एक कर्नल मेमोरी ड्राइवर शामिल है। इसमें सॉफ्टवेयर इंटरप्ट्स और हार्डवेयर ब्रेकपॉइंट्स का उपयोग करके रिमोट प्रोसेसेस में फंक्शन कॉल्स को इंटरसेप्ट करने के लिए एक लाइब्रेरी भी है। यह टूलकिट वर्चुअल मेमोरी हेरफेर में व्यापक क्षमताओं को कवर करता है, जैसे कि स्थानीय या रिमोट प्रोसेसेस में मेमोरी को पढ़ना, लिखना और एलोकेट करना। यह विशिष्ट बाइट सीक्वेंस का पता लगाने के लिए मेमोरी पैटर्न सर्चिंग और बाइनरीज को इंजेक्ट या इजेक्ट करने के लिए मॉड्यूल मैनेजमेंट के लिए यूटिलिटीज भी प्रदान करता है।

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

PINCE is a dynamic debugger, instruction tracer, and memory scanner designed for the analysis and manipulation of running processes. It functions as a process memory manipulator and editor, allowing for the identification, modification, and monitoring of values within a target application's active memory. The tool distinguishes itself through memory pointer analysis, tracing addresses and offsets to locate static pointers that lead to dynamic data across different sessions. It also enables the execution of internal functions within a running process by manipulating the instruction pointer and