memory-forensics · GitHub Topics

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

翻译 - 扫描给定的进程。识别并转储各种潜在的恶意植入物（替换/注入的PE，shellcode，hook，内存中的修补程序）。

pe-format hooking pe-dumper pe-analyzer libpeconv process-analyzer scans anti-malware pe-sieve malware-analysis memory-forensics

C++ 3.25 k

14 天前

hasherezade / hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

翻译 - 扫描所有正在运行的进程。识别并转储各种潜在的恶意植入（替换/植入的 PE、shellcode、挂钩、内存中的补丁）。

pe-sieve anti-malware malware-analysis malware-detection memory-forensics

C 2.12 k

18 天前

stuxnet999 / MemLabs

Educational, CTF-styled labs for individuals interested in Memory Forensics

翻译 - CTF风格的教育性实验室，面向对记忆取证感兴趣的个人

forensics dfir memory-forensics Windows ctf ctf-challenges digital-forensics 安全 Cybersecurity

Shell 1.7 k

4 年前

microsoft / avml

AVML - Acquire Volatile Memory for Linux

Rust memory-forensics linux-security

Rust 914

16 天前

hasherezade / mal_unpack

Dynamic unpacker based on PE-sieve

libpeconv pe-sieve memory-forensics malware-unpacker malware-analysis

C 707

1 个月前

swwwolf / wdbgark

WinDBG Anti-RootKit Extension

kernel-mode C++Malware malware-analysis malware-research forensic-analysis windbg windbg-extension anti-rootkit Windows Visual Studio driver memory-forensics anomaly-detection user-mode debugging-tool

C++ 629

5 年前

LETHAL-FORENSICS / MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

PowerShell incident-response dfir digital-forensics memory-forensics

PowerShell 590

2 天前

teamdfir / sift

SIFT

forensics sans memory-forensics saltstack 命令行界面 Amazon Web Services cast

502

1 年前

patois / IDACyber

Data Visualization Plugin for IDA Pro

ida cyber 数据可视化 ida-pro idapython-plugin 逆向工程 memory-hacking Pixel Art color-filter memory-forensics firmware-analysis exploitation

Python 289

2 年前

cado-security / varc

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

Amazon Web Services aws-fargate aws-lambda cloud-security dfir dfir-automation forensics memory-forensics aws-forensics docker-forensics 安全 Hacktoberfest

Python 254

4 个月前

LETHAL-FORENSICS / Collect-MemoryDump

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

PowerShell dfir digital-forensics incident-response memory-forensics

PowerShell 226

23 天前