Open-source alternatives to Pcileech

macOS forensic acquisition made simple

AVML - Acquire Volatile Memory for Linux

🧭 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system

Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

This project is a software-defined radio platform designed to capture, analyze, and broadcast radio frequency signals across a wide spectrum. It provides a programmable hardware interface for transmitting and receiving radio signals, enabling spectrum analysis and wireless data monitoring. The system is distinguished by its ability to synchronize multiple devices using a shared external clock and hardware triggers to ensure precise timing and sample accuracy. It supports advanced signal routing, allowing ports to be mapped based on frequency or time to enable specialized operations like pseud

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Cyberduck is a multi-protocol file transfer client and cross-platform file manager for Mac and Windows. It functions as a cloud storage manager and remote storage mounter, allowing users to upload, organize, and synchronize data between local drives and remote endpoints. The application provides a unified interface for managing files across FTP, SFTP, WebDAV, S3, and other cloud storage protocols, including Amazon S3, Backblaze B2, Microsoft Azure, and OneDrive. It distinguishes itself with a client-side encryption vault that encrypts files and folders locally before they are transmitted to r

FileCentipede is a comprehensive file management and transfer application designed to handle diverse network protocols and data operations. It functions as a multi-protocol download manager, a full-featured BitTorrent client, and a remote filesystem manager, providing a unified interface for moving and organizing data across local and remote environments. The application distinguishes itself through deep browser integration, which allows for the direct capture of media streams, video, and bulk download links from web pages. It also includes a modular utility suite that enables users to perfor

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

Awesome-adb is a curated collection of resources and utilities designed for interacting with Android devices via the command line. It serves as a comprehensive toolkit for developers and system administrators to facilitate the development, testing, and maintenance lifecycle of mobile applications and system software. The project provides a centralized reference for leveraging the Android Debug Bridge to perform complex tasks, including mobile automation, system-level debugging, and device fleet management. It covers a wide range of capabilities such as simulating user input for stress testing

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

TrollStore is an application installer for iOS that enables the deployment of unsigned software on restricted mobile devices. By bypassing standard code signature verification and security sandbox requirements, it allows users to install and execute applications that originate from outside official distribution channels. The utility functions as an entitlement injection tool, modifying application metadata during installation to grant elevated system permissions. It achieves this by injecting developer certificates into software bundles and utilizing kernel-level modifications to permit the e

JavaCPP is a JNI C++ bridge and foreign function interface that provides a binding generator, a native library loader, and a native memory manager. It automates the creation of Java wrappers around native C++ headers and shared libraries to enable interoperability between the two languages. The project features a C++ binding generator that parses header files to automatically produce the necessary glue code and interfaces for calling native functions. It includes a native library loader that locates and extracts platform-specific binaries from the classpath into a local cache for runtime exec

WinPwn is a Windows penetration testing framework designed for conducting internal security assessments and privilege escalation. It functions as a suite for Active Directory security auditing, credential extraction, and the execution of privilege escalation scripts. The toolset enables the automation of SMB relay attacks to intercept and reuse authentication hashes. It provides specialized capabilities for retrieving passwords and hashes from system memory, registries, and browsers using obfuscated techniques to avoid detection. The framework covers broad capability areas including domain a

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

This project is a reference library of firmware examples and a development framework for creating embedded C applications on the RP2040 microcontroller. It provides a collection of hardware peripheral drivers and foundational patterns for managing system resources in resource-constrained environments. The library features reference implementations for programmable I/O state machines, allowing for the creation of custom hardware-level protocols. It also provides a multicore embedded framework to distribute computational workloads across multiple processor cores using symmetric processing. The

MimiPenguin is a Linux memory credential extractor and password recovery tool designed to isolate and retrieve cleartext user login passwords from active process memory. It functions as a post-exploitation utility for extracting sensitive credentials from desktop user sessions during security assessments. The tool performs Linux memory forensics by analyzing system process memory to identify and isolate credentials. It is used for security penetration testing and evaluating risks associated with memory-based attacks, as well as testing for local privilege escalation. The system targets user-

STM32duino-bootloader is a firmware bootloader and microcontroller firmware flasher designed for STM32 microcontrollers. Operating as a low-level startup routine, it initializes microcontroller peripherals, handles USB communication routines, and launches user applications upon system reset. This enables direct USB programming and application execution on the hardware without requiring external hardware programmers. The bootloader supports firmware updates by presenting the microcontroller as a USB storage device that accepts binary drag-and-drop file transfers. It writes incoming firmware by

mGBA is a high-accuracy Game Boy Advance emulator and hardware-level debugger designed to run handheld console ROMs on modern computers. It serves as a scriptable emulation environment that allows for the execution of portable hardware software and the simulation of associated peripherals. The project distinguishes itself through its focus on technical analysis, providing a suite of tools for retro game debugging and game logic inspection. It includes a host-client debug protocol that enables external debugger connectivity via TCP socket communication and an event-driven scripting engine for

Blackbone is a collection of specialized tools for memory scanning, process injection, and kernel-driver interfaces used to manipulate the Windows execution environment. It provides a framework for executing remote code, mapping portable executable images, and managing threads across different process boundaries. The project includes a kernel memory driver to access kernel memory and modify handle rights to hide allocations from user-mode detection. It also features a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints. The toolkit c

probe-rs is an embedded debugging toolset used for flashing, debugging, and inspecting microcontrollers via hardware debug probes. It functions as an embedded firmware flasher, a memory manager for reading and writing to processor registers, and a server implementing the Debug Adapter Protocol to connect hardware debugging to various code editors. The project includes a CMSIS-Pack target parser to extract device metadata and flash configurations from industry-standard definition files. It provides a driver-based probe abstraction to interact with various hardware debug probes regardless of th

The Intel Processor Performance Monitor is a set of specialized diagnostic tools designed for monitoring raw hardware events, memory latency, PCIe throughput, and processor power states on Intel architecture. The project provides dedicated utilities for measuring data throughput across sockets and PCIe buses, tracking power usage and sleep states to identify frequency throttling, and analyzing cache misses and memory access times. It also includes a hardware event profiler for querying raw core and uncore register events to monitor specific processor behaviors. Capabilities cover comprehensi

TIC-80 is a fantasy console platform and multi-language game engine that provides a virtual retro game development environment. It operates via a bytecode virtual machine that executes game logic within fixed memory and resolution constraints. The project distinguishes itself by offering integrated asset editors for pixel art, tile maps, and a pattern-based chiptune audio workstation all within a single environment. It supports multi-language scripting, allowing developers to write logic in Lua, JavaScript, or Ruby, and provides a standalone game exporter to package projects into native execu

Steam Achievement Manager is a game achievement editor and specialized API client designed to modify and unlock game achievements and statistics for titles on the Steam platform. It functions as a utility for manually changing the state of earned rewards and milestones while the client is running. The tool provides capabilities for steam profile customization and game statistic manipulation, allowing users to adjust displayed progress and achievement states. It operates by interfacing with the platform backend to update user profile data.

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

JNA is a foreign function interface and native memory mapper that allows Java applications to call functions in shared native libraries without writing custom JNI wrapper code. It serves as a JNI alternative framework for invoking C functions and mapping native data structures using high-level interfaces. The library distinguishes itself through its ability to translate Java objects and primitives into C-style structs, unions, and pointers for cross-platform memory exchange. On Windows, it provides a dedicated toolkit for interacting with Component Object Model objects using both early and la