AMSI-patches-learned-till-now

AMSI-patches-learned-till-now I have documented all of the AMSI patches that I learned till now ❗ My AMSI patch Learning till now. Doesn't belong to my Company's Asset! DISCLAIMER: This code is not meant to be Evasive till now! Only a Conceptual Approach. Links: 1...

DotDumper

DotDumper An automatic unpacker and logger for DotNet Framework targeting files! This tool has been unveiled at Black Hat USA 2022. At Black Hat Asia 2023, DotDumperGUI and DotDumperNative were published, along with version 1.1-stable of DotDumper. These three tools are meant to be used together,...

MemTracer

MemTracer MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework...

YAMA-dev

YAMA Yet Another Memory Analyzer for malware detection Concept YAMA is a system for generating scanner that can inspect specific malware during incident response. The scanner generated by YAMA is designed to explore the memory of Windows OS and detect malware. With the increasing prevalence of...

VolWeb

Introduction VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. 🧬 Objectives The goal of VolWeb is to enhance the efficiency of memory collection and forensic analysis by...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

gentlemen-decryptor

The Gentlemen Ransomware Decryptor The first publicly available decryption method for The Gentlemen ransomware. The Gentlemen also known as hastalamuerte is currently the most active ransomware-as-a-service RaaS operation globally, with 320+ confirmed victims as of Q1 2026. Until now, every major...

grr

GRR Rapid Response is an incident response framework focused on remote live forensics. GRR is a python client agent that is installed on target systems, and python server infrastructure that can manage and talk to clients. Documentation Please visit our documentation website if you want to know...

pybof

PyBOF Run Beacon Object files through python in-memory loading and execution of BOFs PyBOF enables Python3 to load Beacon Object Files via bytes and execute a target BOF function in a Python interpreter Basic Usage Run a simple BOF with no required arguments data = openr'c:\path\to\example.o',...

CVE-2022-20186

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

memoro

Memoro Memoro is a highly detailed heap profiler. Memoro not only shows you where and when your program makes heap allocations, but will show you how your program actually used that memory. Memoro collects detailed information on accesses to the heap, including reads and writes to memory and when...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

dezlock-dump

dezlock-dump Extracts everything from a running Source 2 game Deadlock, CS2, Dota 2 and generates a patch-proof C++ SDK that resolves offsets at runtime. No hardcoded values, no manual updates when the game patches. Quick Start 1. Download from Releases or build from source 2. Launch your game —...

HeaderLessPE

HeaderLessPE Introduction 中文 HeaderLessPE is a memory PE loading technique used by the Icedid Trojan. Based on this technology, we propose a new way of file-less attack using HVNC . This enhancement allows to inject HeaderLessPE into execute graphical hacking tools without limitations. Compared t...

VolExp

VolExp Volatility Explorer This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access...

tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say sudo dnf install tcpflo...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

CVE-2022-21894

baton drop CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. The truncatememory BCD element...

SwishDbgExt

SwishDbgExt SwishDbgExt is a Microsoft WinDbg debugging extension that expands the set of available commands by Microsoft WinDbg, but also fixes and improves existing commands. This extension has been developed by Matt Suiche @msuiche – feel free to reach out on [email protected] ask for mor...