CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

Mhyprot2DrvControl

Mhyprot2DrvControl A lib that allows using mhyprot2 driver for enum process modules, r/w process memory and kill process. Usage Build and run, see Driver\MhyProt2.cs for available function and usage. Demo...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

proctools

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes . Made to accompany FormThief. procsearch - find sensitive strings in target process memory searches for parsed string in readable process memory, if found, displays a range of valid ASCII char...

CVE-2023-32784-kdbxpassdmp

keepassdumper.py Python port of vdohney/keepass-password-dumper CVE-2023-32784 — all credit for the original C implementation and the underlying technique goes to vdohney. The script scans a process memory dump for the leftover render strings that KeePass 2.x's SecureTextBoxEx leaves behind while...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To search for keys i...

truffleproc

truffleproc — hunt secrets in process memory Usage Run truffleproc.sh against your current Bash shell e.g. $$: $ ./truffleproc.sh $$ coredumping pid 6174 Reading symbols from od... Reading symbols from /usr/lib/systemd/systemd... Reading symbols from /lib/systemd/libsystemd-shared-247.so... Readi...

KeePass-CVE-2023-32784-Exploitation-and-Defense

KeePass Memory Leak Vulnerability CVE-2023-32784:Exploitation & Defense Architecture Objective To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe v2.53, demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls. The...

CVE-2026-112482

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to corrupt process memory...

AzTokenFinder

AzTokenFinder Is a small tool to extract JWT or JWT like looking data from different processes, like PowerShell, Excel, Word or others. The idea was inspired from the blog post https://mrd0x.com/stealing-tokens-from-office-applications/ from the amazing @mrd0x. In the new release, I added the...

EUVD-2026-110387

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory...

EUVD-2026-110144

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service or disclose process memory...

EUVD-2026-110291

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may disclose process memory...

CVE-2026-112454

A memory handling issue in various Apple operating systems—including iOS 27.2 , iPadOS 27.2 , macOS Golden Gate 27.2 , tvOS 27.2 , visionOS 27.2 , and watchOS 27.2 —was addressed with improved memory handling. Processing a maliciously crafted video file could result in corrupt process memory or u...

EUVD-2026-110341

The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory...

EUVD-2026-110323

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

memscan

memscan Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space Memory/Process Scanner Written by Matt Lewis, NCC Group 2014 Updated by Tom Watson, NCC Group 2015 Thanks to Jesse Bullock for lots of great ideas Released as open source by NCC Gro...