Awesome GitHub RepositoriesBinary Memory Dumping

This project is a collection of educational resources and step-by-step tutorials for Java backend development. It provides implementation guides for building web services and applications using the Spring Boot framework, focusing on the development of data streams and concurrent tasks. The repository includes technical walkthroughs for Kubernetes cluster automation, specifically regarding the creation of custom operators and admission controllers. It also serves as a manual for cloud native integration, covering the packaging of applications into containers and the use of distributed event me

Stetho is a debug bridge that connects Android applications to Chrome Developer Tools. It allows for the real-time inspection of network traffic, internal application state, and the user interface layout directly within a desktop browser. The project provides specialized inspectors for analyzing Android-specific components. This includes a network inspector for capturing HTTP requests and responses, an SQLite database browser for querying local storage, and a view hierarchy inspector for mapping UI elements and styles. Additional capabilities cover runtime execution via an embedded JavaScrip

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

MAME is a vintage hardware emulation platform designed to recreate the circuitry of arcade games, computers, and consoles to run original software on modern devices. It functions as a retro gaming preservation framework for managing, verifying, and archiving ROM sets and disk images to ensure long-term software accessibility. The project features a system debugging tool for inspecting emulated memory, CPU registers, and execution flow via breakpoints and disassembly. It also includes a Lua-based automation layer that exposes core system state and hardware controls for custom behavior and anal

Bottlerocket is a container-optimized operating system and minimal Linux distribution designed specifically for hosting container workloads. It functions as an immutable infrastructure OS, utilizing a read-only root filesystem and atomic partition swapping to ensure consistent and reversible system updates. The system is distinguished by an API-driven host manager that replaces traditional shell-based configuration with a local REST API for administrative tasks. To maintain security and stability, it employs a dual-runtime isolation model that separates workload runtimes from system operation

Il2CppDumper is a reverse engineering tool that recovers original .NET assembly structure from Unity games compiled with il2cpp. It parses il2cpp binaries across multiple executable formats including ELF, Mach-O, PE, NSO, and WASM, and reconstructs the original DLL structure from embedded metadata tables, enabling decompilation and analysis of game code. The tool generates disassembler scripts for IDA, Ghidra, and Binary Ninja that apply recovered type definitions and structure layouts to the binary analysis. It also strips protection layers from memory-dumped libil2cpp.so files and simple PE

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

gops is a command-line diagnostic toolset for monitoring, profiling, and managing the runtime state of active Go applications. It functions as a runtime diagnostic tool that provides a focused interface for analyzing memory, profiling performance, and monitoring the health of running processes. The tool provides a set of specialized utilities including a performance profiler for capturing CPU and heap profiles, a memory analyzer for identifying leaks and triggering garbage collection, and a process monitor for discovering running binaries and visualizing process hierarchies. The project cove

Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis. The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes. The capability surface

Rockstar is an esoteric programming language whose syntax is inspired by 1980s hard rock and heavy metal lyrics, making programs read like song lyrics. It uses poetic number literals, where the length of each word in a phrase is parsed as a decimal digit to initialize numeric variables, and pronoun-based variable references, where words like "it" and "they" resolve to the most recently assigned or compared variable at runtime. The language can be compiled to WebAssembly and run inside a web page for in-browser code execution. The language distinguishes itself through a lyric-driven parsing sy

This project is a comprehensive technical guide and diagnostic manual for analyzing memory, performance, and asynchronous behavior within Node.js applications. It provides detailed methods for asynchronous tracing, memory diagnostics, and performance analysis to resolve runtime errors and execution bottlenecks. The resource distinguishes itself by covering advanced diagnostic workflows, including the use of flame graphs for CPU profiling, the capture and comparison of heap snapshots for memory leak detection, and the mapping of asynchronous call stacks. It also provides technical guidance on

The C/C++ extension for Visual Studio Code provides language support for C and C++ programming, including IntelliSense-powered code editing, navigation, and debugging capabilities. It enables syntax highlighting, code completion, hover information, and error checking for C and C++ source files, along with features like semantic colorization, symbol search, and call hierarchy exploration. The extension offers comprehensive debugging support for C/C++ programs, including launching debug sessions with breakpoints, stepping through code, and inspecting variables. It supports debugging multi-threa

MifareClassicTool is an Android application for reading, writing, cloning, and analyzing MIFARE Classic RFID tags using built-in NFC hardware or external USB readers. The tool provides sector-based authentication using key files and dictionary attacks, enabling selective data extraction from protected tag sectors. The application includes a hex editor for viewing and modifying raw tag dump data with sector and block highlighting, along with tools for decoding and encoding access condition bytes and value blocks. It supports cloning full dumps or UIDs to compatible magic tags, including manufa

Cuberite is a high-performance multiplayer game server for Java Edition clients, designed to provide a low-memory and low-CPU environment for hosting shared virtual spaces. The server is built for cross-platform deployment across various operating systems and hardware types. It allows for the extension of game mechanics and server logic through a Lua scripting interface, enabling functionality changes without recompiling the core engine. The project includes tools for server administration via a remote console and world data management for analyzing statistics and optimizing save file storag

Hooker este un toolkit pentru instrumentarea dinamică, analiza memoriei și deobfuscare a aplicațiilor Android. Funcționează ca un framework de reverse engineering care utilizează Frida pentru a injecta scripturi în procesele care rulează, a monitoriza apelurile native și a extrage fișiere DEX executabile. Proiectul oferă utilitare specializate pentru ocolirea controalelor de securitate, inclusiv instrumente pentru dezactivarea validării certificatelor SSL și a pinning-ului BoringSSL pentru a permite interceptarea traficului HTTPS. Include capabilități pentru detectarea împachetării aplicațiilor, extragerea cheilor criptografice prin hooking-ul algoritmilor de criptare și evitarea verificărilor de mediu root sau de debugging. Framework-ul acoperă o gamă largă de capabilități de analiză, inclusiv scanarea memoriei pentru detectarea componentelor active, configurarea proxy SOCKS5 pentru rutarea traficului de rețea și analiza interacțiunii cu UI-ul. De asemenea, suportă colectarea amprentelor dispozitivului și debugging-ul WebViews-urilor încorporate.

GlusterFS este un sistem de fișiere distribuit definit prin software și un cluster de stocare scale-out care agregă resursele de disc de la mai multe servere într-un singur namespace global. Funcționează ca o platformă de stocare unificată, permițând ca aceleași date subiacente să fie expuse prin interfețe de stocare de fișiere, bloc și obiect. Sistemul se distinge printr-o arhitectură descentralizată care utilizează hashing consistent pentru a distribui fișierele pe nodurile de rețea fără un server de metadate central. Asigură integritatea și disponibilitatea datelor folosind replicarea self-healing, consistența bazată pe cvorum pentru a preveni scenariile de split-brain și geo-replicarea asincronă pentru recuperarea în caz de dezastru în locații geografice îndepărtate. Platforma oferă o acoperire largă a capabilităților prin exportul de stocare multi-protocol via NFS, Samba și iSCSI, precum și gestionarea cuprinzătoare a volumelor, inclusiv snapshot-uri point-in-time, cote de stocare și expansiunea elastică a capacității. Securitatea este gestionată prin criptare TLS pentru datele în tranzit, integrarea gestionării identității și controlul granular al accesului POSIX. Software-ul este disponibil ca pachete binare prin repository-urile comunității pentru diverse distribuții Linux.

This project is a comprehensive Android reverse engineering suite that functions as a decompiler, bytecode deobfuscator, and malware analysis tool. It is designed to convert APK, DEX, and OAT binaries into human-readable source code using a native implementation that does not require a Java Virtual Machine. The platform is distinguished by its integration with Frida for dynamic analysis, allowing users to hook methods, inject custom JavaScript, and dump device memory in real time. It also features specialized security engines, including a taint propagation engine and a stack-state machine, to

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

MemProcFS este un instrument de analiză a memoriei volatile și un sistem de achiziție a memoriei cross-platform. Acesta funcționează ca un sistem de fișiere virtual pentru criminalistica memoriei, mapând memoria fizică și obiectele kernel-ului într-o structură de directoare virtuală care permite utilizatorilor să analizeze artefactele sistemului folosind instrumente standard de sistem de fișiere. Proiectul se distinge prin furnizarea unui sistem de fișiere virtual pentru criminalistica memoriei, permițând navigarea și interogarea memoriei fizice ca fișiere și foldere read-only. De asemenea, încorporează un scaner de memorie bazat pe Yara pentru a identifica semnăturile malware și codul injectat în memoria fizică. Motorul acoperă o gamă largă de capabilități criminalistice, inclusiv inspecția proceselor și thread-urilor, listarea conexiunilor de rețea și analiza registry-ului Windows. Suportă ingestia de date din sisteme live, crash dump-uri și mașini virtuale, oferind în același timp rezoluția simbolurilor pentru a traduce adresele brute de memorie în nume semnificative. Integrarea este suportată printr-o interfață programatică multi-limbaj și wrappere de biblioteci native pentru C și Java, precum și scripting Python headless pentru fluxuri de lucru automatizate.