memory-forensics

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Educational, CTF-styled labs for individuals interested in Memory Forensics

AVML - Acquire Volatile Memory for Linux

Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.

Dynamic unpacker based on PE-sieve

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

WinDBG Anti-RootKit Extension

SIFT

Data Visualization Plugin for IDA Pro

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

Allows you to quickly query a Windows machine for RAM artifacts

Hyper-V Research is trendy now

A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University

A curated list of awesome malware analysis tools and resources

Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.

First open-source DMA-based HWID spoofer written in Rust. Spoof hardware IDs via direct memory access.

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

Umbrella Spoofer is a Windows utility designed to modify and manage system identifiers used by software and games. It provides a simple interface for applying configurable system-level changes for testing, troubleshooting, and privacy-related purposes.